When you visit a trusted website like YouTube, you expect to be free from the threat of viruses and hacks. However, for a period of time last week, malicious ads displayed on the second most visited site on the web were using the CPUs of visitors to generate cryptocurrency.
The incident was confirmed by Google in a statement to Ars Technica that claimed the “ads were blocked in less than two hours and the malicious actors were quickly removed from our platforms.”
The ads used a script called Coinhive to take advantage of the processing power of YouTube visitors to mine the cryptocurrency Monero. Coinhive is a script that allows website owners to generate income from their website by using the computers of visitors to mine crypto.
The idea behind scripts like Coinhive is that, as long as users are warned about what is happening, it is an ethical way to provide an ad-free experience while still being able to profit from running a site. However, in this case, the hackers were able to utilize the distribution of YouTube adverts to reach a high number of potential victims.
There have been many cases of websites or even apps running crypto-mining scripts in the background in order to take advantage of the computing power of unwitting visitors. But this is the first time we’re hearing of crypto-mining ads on a large platform such as YouTube.
YouTube was likely chosen as the platform due to the fact that visitors to YouTube stay on one page for longer than on other websites and, therefore, can be taken advantage of for longer.
The scripts were first caught after users complained that their antivirus software was flagging up certain adverts on the site for being cryptocurrency.
Crypto-mining scripts are worrying because, as well as being a breach of trust, they can also seriously slow down a user’s computer due to the fact that they are programmed to use up to 80 percent of a computer’s CPU, which can be a major annoyance for laptop and tablet users.