Cryptocurrency mining on browser is becoming a popular option for earning money by using the visitor’s system resources. It first started with CoinHive. All one needs is few lines of javascript code to start using the CPU resources of the visitor. However most decent adblock plugins can now easily block the CoinHive and few other crypto mining scripts.
What caught my attention was that almost all of them (adblock plus, ublock origin etc.) fail to block “CoinNebula”. Unlike Coinhive which loads from coinhive website, CoinNebula library is hosted on the same server as the website. This makes it a little bit hard to block.
Windows Defender Security Intelligence first reported about it on 16 Oct 2017:
“We recently discovered CoinNebula, a new coin miner that we observed in several video-streaming sites. Unlike CoinHive, the CoinNebula library is hosted on the same web server as the coin miner.”
So without wasting anyone’s time, Let’s start our mission to stop CoinNebula for good.
Install Ublock Origin:
You need to install Ubock Origin on your Firefox or Chrome browser. I suppose you can also do it with Adblock plus but not really sure.
Go into Dashboard:
Click on Ublock Origin icon and then “open the dashboard”.
Filters:
Click on “my filters” tab.
Now what we need to do is use the “Inline script tag filtering” feature of uBlock origin. You can understand and implement it easily by going to official github page of uBlock. However here’s the thing though: What we are trying to achieve is to only block the inline script related to crypto mining. Simply blocking all the inline scripts will hinder the experience and you may even experience problems in loading the web page. So what we need to do is to use cosmetic filtering.
So let’s take a look at the code of CoinNebula to figure out a way to block it:
<script type=”text/javascript”>
var iner = null;
if(typeof CoinNebula === ‘object’) { iner = new CoinNebula.Instance(‘xx’, {throttle: 0.7}); if(!iner.isMobile()) iner.start();}
</script>
This is the example of script tag cosmetic filter:
example.com##script:contains(…)
So here’s the final cosmetic filter to totally block the CoinNebula:
example.com##script:contains(CoinNebula)
example.com##script:contains(throttle)
Replace example.com with the domain name of the site from where you want to block the CoinNebula.
Simple add the above 2 rules in “My Filters” tab and click on “Apply changes”.
If you noticed, I have added 2 rules while all we need is just 1 rule. I just added another one to be extra sure because no one wants their precious CPU resources to be used without consent. I have tested it on both Firefox and Chromium based browsers and it gets the job done. Let me know in comments if this works out for you or you are facing any problems.
Leave a Reply