{"id":486,"date":"2018-07-31T03:42:08","date_gmt":"2018-07-31T03:42:08","guid":{"rendered":"https:\/\/blog.hassler.ec\/wp\/?p=486"},"modified":"2018-07-18T03:45:12","modified_gmt":"2018-07-18T03:45:12","slug":"i-built-a-screenshot-api-and-some-guy-was-mining-cryptocurrencies-with-it","status":"publish","type":"post","link":"https:\/\/blog.hassler.ec\/wp\/2018\/07\/31\/i-built-a-screenshot-api-and-some-guy-was-mining-cryptocurrencies-with-it\/","title":{"rendered":"I built a screenshot API and some guy was mining cryptocurrencies with\u00a0it."},"content":{"rendered":"

Hey folks, just wanted to share this story. Yes, I could have been better prepared for what happened, I know.\u00a0\ud83d\ude42<\/em><\/p>\n

This morning when I opened up my inbox, I had around 150 alert emails from the the logging tool I use. I immediately though I must have pushed a nasty bug to production and started investigating. I quickly realized some guy was creating new accounts really fast on our\u00a0screenshot API service<\/a>\u00a0and was rapidly using all the free plan credit.<\/p>\n

\n
\n
<\/div>\n
<\/canvas><\/div>\n<\/div>\n<\/figure>\n

He was making screenshots of this page\u00a0https:\/\/cnhv.co\/2uujp<\/a>\u00a0to mine cryptocurrencies on the machines hosting the chrome instances we use to make screenshots.<\/p>\n

I figured he was hanging out on\u00a0ApiLeap<\/a>\u2019s homepage so I could reach him through Crisp, the tool we use to chat with potential clients. Here is the conversation we had:<\/p>\n

Me:<\/em><\/strong>\u00a0Hi. Please stop creating multiple accounts on ApiLeap, you\u2019re violating the terms of service.<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0how do you know?<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>From our admin interface we have metrics to monitor usage.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>so u tracked my ip? wow!!!<\/em><\/p><\/blockquote>\n

Me:<\/em><\/strong>\u00a0We have legal obligation to gather data from our clients.<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0oh. sorry. i was using your server for mining cryptocurrency<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0sorry i will stop it<\/em><\/p><\/blockquote>\n

Me:<\/em><\/strong>\u00a0Thank you.<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0will there be any legal proceedings\u00a0? ?<\/em><\/p><\/blockquote>\n

Me:<\/em><\/strong>\u00a0If you stop now. No. If you continue yes.<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0but its your fault. you have not implemented any mechanisms to prevent bots or automated access<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>We allow users to create accounts freely, but we have various tools in place to ban people. We also have a contractor that can build a legal case if needed.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>ok i understand. but its your duty to make sure that automated softwares cannot make account on your site<\/em><\/p><\/blockquote>\n

Me:<\/em><\/strong>\u00a0We might add more security if we feel the need.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>i am web developer too. i can help you<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>i just created a tool in php for automatically creating accounts on your site. ?<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>We figured. ?<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>Selenium\u00a0?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>no php curl<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>i can help you if you want<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>so\u00a0, you have no idea about site security or are you just too lazy to implement it? ?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>please implement a captcha in your site\u00a0. it will prevent all those automated tools<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>Thank you for your advice.<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>Are we the first website you are attacking\u00a0?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>no.. ?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>this is my hobby<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>for fun and profit<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>Do you make decent money from coinhive\u00a0?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>no. i have not made anything yet<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>so i thought of using such sites to mine some coins. ?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>i am sorry if you had any loss<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>It’s ok we haven’t lost anything.<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>There is a bunch of other screenshot website you might want to try. ?<\/em><\/p><\/blockquote>\n

Him:<\/em><\/strong>\u00a0?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>it will consume their processing power\u00a0. you know it<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>Yes it’s in browser monero mining.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>btw why would you want me to try other websites? just to make some loss for them? ?<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>No, don’t. I was just joking. ?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>ok.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>can i be a part of your team\u00a0?<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>i’m sorry but we already have a developer in house.<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>anyway it was nice meeting you.<\/em><\/p><\/blockquote>\n

Me:\u00a0<\/em><\/strong>I’m sure you’re a great guy deep inside. There is a ton of better ways to make money as a developer. It was nice meeting you too. Good luck\u00a0! I hope your life is going to be great\u00a0! ?<\/em><\/p><\/blockquote>\n

Him:\u00a0<\/em><\/strong>thanks. bye ?<\/em><\/p><\/blockquote>\n

I think it\u2019s one of the most pacific way I did mitigate an attack, and he was not that bad of a guy after all. ?<\/p>\n

 <\/p>\n

SOURCE:\u00a0https:\/\/medium.com\/@timotheejeannin\/i-built-a-screenshot-api-and-some-guy-was-mining-cryptocurrencies-with-it-cd188dfae773<\/a><\/strong><\/p>\n

 <\/p>\n

Timoth\u00e9e Jeannin<\/a><\/h3>\n

Building ApiLeap\u00a0https:\/\/apileap.com<\/a>, a Netcube product.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hey folks, just wanted to share this story. Yes, I could have been better prepared for what happened, I know.\u00a0\ud83d\ude42 […]<\/p>\n","protected":false},"author":2,"featured_media":248,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[49,80,81,47,16],"tags":[],"class_list":["post-486","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-back-end","category-bitcoint","category-criptocurrency","category-medium","category-servidores"],"_links":{"self":[{"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/posts\/486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/comments?post=486"}],"version-history":[{"count":3,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/posts\/486\/revisions"}],"predecessor-version":[{"id":571,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/posts\/486\/revisions\/571"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/media\/248"}],"wp:attachment":[{"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/media?parent=486"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/categories?post=486"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hassler.ec\/wp\/wp-json\/wp\/v2\/tags?post=486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}