A comment on using CPU resources

[Gandalf The White]

Greetings and Salutations:

I had an issue with my Firefox browser. The browser was static, yet it was
using 70% or 80% of the CPU of the system.

It got me to thinking. Java is a programming language. What would prevent
companies from running a java script on your computer while you are viewing
their page that uses your CPU to do some computing for them? Instead of
selling (or in addition to selling) advertising the company could also sell
CPU to other companies.

Is this feasible?

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
Woodworking For Geeks - http://digital.net/~gandalf/woodmain.htm

[Jeroen van Rijn]

Hi Ken,

There have been java applets that did this with the user's consent, e.g.
the MD5crack distributed computing effort had one:
http://distributedcomputing.info/recent.html ,
http://www.engsoc.org/~jlcooke/
It is not inconceivable one could do something useful with
ecma/java/j-script too, however it would have to be some variant of AJAX
to be useful to whomever wrote/hosted the script?
However, I don't think you're likely to see anyone stealing your CPU
time with this as of yet.

Maybe someone else has different thoughts on the matter

- Jeroen.

>Greetings and Salutations:
>
>I had an issue with my Firefox browser. The browser was static, yet it was
>using 70% or 80% of the CPU of the system.
>
>It got me to thinking. Java is a programming language. What would prevent
>companies from running a java script on your computer while you are viewing
>their page that uses your CPU to do some computing for them? Instead of
>selling (or in addition to selling) advertising the company could also sell
>CPU to other companies.
>
>Is this feasible?
>
>Ken
>
>---------------------------------------------------------------
>Do not meddle in the affairs of wizards for they are subtle and
>quick to anger.
>Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
>WWW Page - http://digital.net/~gandalf/
>Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
>Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
>Woodworking For Geeks - http://digital.net/~gandalf/woodmain.htm
>
>

[Security]

> I had an issue with my Firefox browser. The browser was static, yet it
> was
> using 70% or 80% of the CPU of the system.
> It got me to thinking. Java is a programming language. What would
> prevent
> companies from running a java script on your computer while you are
> viewing
> their page that uses your CPU to do some computing for them? Instead of
> selling (or in addition to selling) advertising the company could also
> sell
> CPU to other companies.

I was thinking something along these same lines the other day.

The only drawbacks I could figure (and possible solutions to) are:

- Not all clients will be executing the java (security problems, lack of
java, etc.)
- Not all clients will complete the execution of the java (could be avoided
by having smaller code blocks executed in series or parallel with a
push/pull on the clientside when the block completes.) This would occur if
the user hits back or closes the browser, and utilizing a onclose() or
onblur() or whatnot will help although not all clients will honor these.
- Not all users will like this, should they find out you are doing it what
kind of legal trouble could you get into (if any)?

You'd need a lot of people running this for any reasonable amount of CPU
cycles being available to you, and some very intuitive code to deal with
running for an unknown amount of time (before the user clicks something).

Another thing to think of, flash animation clicks that are handled by the
movie won't stop java. The user can click an item in the flash movie without
changing the current document's href, which will leave your java threads
running. This is a way to ensure your code is executed for at least as long
as it takes to load the flash, if the user waits at least that long.

Just my $0.02, as I said I was putting some thought into this just the other
day, although I hadn't considered selling the CPU cycles.

Chris @ Sustained Hits

[Andreas Bartelt]

Hi,

Gandalf The White wrote:
> Greetings and Salutations:
>
> I had an issue with my Firefox browser. The browser was static, yet it was
> using 70% or 80% of the CPU of the system.
>
> It got me to thinking. Java is a programming language. What would prevent
> companies from running a java script on your computer while you are viewing
> their page that uses your CPU to do some computing for them? Instead of
> selling (or in addition to selling) advertising the company could also sell
> CPU to other companies.
>
> Is this feasible?
>

yes, it's technically feasible with Java and also with JavaScript.

regards,
Andreas

[Joseph Finley]

=20
Kind of like the commercialization of the SETI project combined with
same approach of how these spyware company's drop code on your machine.
I'm sure it's feasible and if it wasn't thought of before, you just now
gave the idea

Joe

-----Original Message-----
From: Gandalf The White [mailto:gandalf@digital.net]=20
Sent: Saturday, July 09, 2005 11:27 AM
To: bugtraq@securityfocus.com
Subject: A comment on using CPU resources

Greetings and Salutations:

I had an issue with my Firefox browser. The browser was static, yet it
was using 70% or 80% of the CPU of the system.

It got me to thinking. Java is a programming language. What would
prevent companies from running a java script on your computer while you
are viewing their page that uses your CPU to do some computing for them?
Instead of selling (or in addition to selling) advertising the company
could also sell CPU to other companies.

Is this feasible?

Ken

[Raghu Chinthoju]

This isn't a new thing, stealing CPU cycles this way is known for some
time now. The following are the reasons I guess why this isn't
feasible:

1. No anonymity. The code is directly visible to the victim.
2. As long as any script is running, the browser shows that the page
is still being loaded. This might drag suspicion to view whats in the
page or the user might simply cancel loading (ie the java script).
Time consuming scripts might have less chances.
3. There are many better ways for a determined CPU thief. For example,
there are plenty of vulnerable machines connected to Internet offering
their everything to hackers in a silver plate.
4. If CPU cycles were really in huge demand, some one could just start
a business offering to pay for in return to lending idle CPU. Guess
not a bad idea ;-)

cheers!
Raghu




On 7/9/05, Gandalf The White <gandalf@digital.net> wrote:
> Greetings and Salutations:
>=20
> I had an issue with my Firefox browser. The browser was static, yet it w=
as
> using 70% or 80% of the CPU of the system.
>=20
> It got me to thinking. Java is a programming language. What would preve=
nt
> companies from running a java script on your computer while you are viewi=
ng
> their page that uses your CPU to do some computing for them? Instead of
> selling (or in addition to selling) advertising the company could also se=
ll
> CPU to other companies.
>=20
> Is this feasible?
>=20
> Ken
>=20
> ---------------------------------------------------------------
> Do not meddle in the affairs of wizards for they are subtle and
> quick to anger.
> Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
> WWW Page - http://digital.net/~gandalf/
> Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
> Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
> Woodworking For Geeks - http://digital.net/~gandalf/woodmain.htm
>=20
>=20
>

[Martin Konold]

Hi,

> I'm sure it's feasible and if it wasn't thought of before, you just now
> gave the idea

I just did this many years ago for a scientific project called xpulsar.

The interesting part about xpulsar was that it required only minimal
bandwidth and was immune against malicious clients providing faked
results.

The scientific question solved was about the motion of photons in a
riemann metric (general relativity) when matter falls on a neutron star.

During four months about 75 computational years (P-III-600 MHz) got
donated. This amount of computational power led to interesting scientific
results.

http://csdl.computer.org/comp/procee...0100588abs.htm

Regards,
--martin

[Scott Marburger]

Several thoughts-

I am reminded of some responses concerning "social engineering", and marvel
as I see people with seven or eight browser windows open and minimized- in
order to maintain "productivity".

I have noticed on my own machine after having two or three windows open and
closing all, that the machine seems sluggish. Going to task manager, I see
one or two copies of Firefox still running, sucking up 30 or 40 percent when
they should have closed.

Shake thoughts well, add pinch of paranoia-

Would it be possible to mask or disguise firefox to appear to be closed
while still running it's java payload? Spitting back it's chunk of data
when done?


Scott Marburger
Director, ICT
The Institute for Public-Private Partnerships, Inc.
Waterfront Center
1010 Wisconsin Avenue
Washington, DC 20007


-----Original Message-----
From: Raghu Chinthoju [mailtoaghu.chinthoju@gmail.com]
Sent: Saturday, July 09, 2005 2:54 PM
To: Gandalf The White
Cc: bugtraq@securityfocus.com
Subject: Re: A comment on using CPU resources


This isn't a new thing, stealing CPU cycles this way is known for some
time now. The following are the reasons I guess why this isn't
feasible:

1. No anonymity. The code is directly visible to the victim.
2. As long as any script is running, the browser shows that the page
is still being loaded. This might drag suspicion to view whats in the
page or the user might simply cancel loading (ie the java script).
Time consuming scripts might have less chances.
3. There are many better ways for a determined CPU thief. For example,
there are plenty of vulnerable machines connected to Internet offering
their everything to hackers in a silver plate.
4. If CPU cycles were really in huge demand, some one could just start
a business offering to pay for in return to lending idle CPU. Guess
not a bad idea ;-)

cheers!
Raghu




On 7/9/05, Gandalf The White <gandalf@digital.net> wrote:
> Greetings and Salutations:
>
> I had an issue with my Firefox browser. The browser was static, yet it
was
> using 70% or 80% of the CPU of the system.
>
> It got me to thinking. Java is a programming language. What would
prevent
> companies from running a java script on your computer while you are
viewing
> their page that uses your CPU to do some computing for them? Instead of
> selling (or in addition to selling) advertising the company could also
sell
> CPU to other companies.
>
> Is this feasible?
>
> Ken
>
> ---------------------------------------------------------------
> Do not meddle in the affairs of wizards for they are subtle and
> quick to anger.
> Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
> WWW Page - http://digital.net/~gandalf/
> Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
> Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
> Woodworking For Geeks - http://digital.net/~gandalf/woodmain.htm
>
>
>

[securityfocus@basicwebdesign.co.uk]

Might this not be useful to those people who are, for example, cracking passwd files, MD5 collisions etc.? Maybe not today but in the future? Couldn't a malicious script aid in finding such information?

[Joachim Schipper]

On 5:26:55 pm 07/09/05 Gandalf The White <gandalf@digital.net> wrote:
> Greetings and Salutations:
>
> I had an issue with my Firefox browser. The browser was static, yet
> it was using 70% or 80% of the CPU of the system.
>
> It got me to thinking. Java is a programming language. What would
> prevent companies from running a java script on your computer while
> you are viewing their page that uses your CPU to do some computing
> for them? Instead of selling (or in addition to selling) advertising
> the company could also sell CPU to other companies.
>
> Is this feasible?
>
> Ken

The short answer is yes.

The long answer is yes, but there are a number of other ways to achieve the
same goal, without having people look at your web page all the time. More
specifically, botnets can be used for computation too...

The moral of this story, of course, is to turn off executing remote
commands (java, javascript, whatever). But that's good practice anyway.

Joachim

[Christian]

Gandalf The White schrieb:
> It got me to thinking. Java is a programming language. What would prevent
> companies from running a java script on your computer while you are viewing
> their page that uses your CPU to do some computing for them?

this was done before, but intentionally by www.md5crk.com. the project
is gone now, but archive.org has it all:

http://web.archive.org/web/200402022...ww.md5crk.com/

--
BOFH excuse #64:

CPU needs recalibration

[Steven Champeon]

on Sat, Jul 09, 2005 at 08:11:42PM +0200, Jeroen van Rijn wrote:
> It is not inconceivable one could do something useful with
> ecma/java/j-script too, however it would have to be some variant of
> AJAX to be useful to whomever wrote/hosted the script?

Only if you wanted the results posted back to the original site /and/
wanted to be able to fetch new data to crunch. Without the last bit,
you don't need anything more than a simple scripted form submit().

--
antispam news, solutions for sendmail, exim, postfix: http://enemieslist.com/

[Steven Champeon]

on Sun, Jul 10, 2005 at 12:23:51AM +0530, Raghu Chinthoju wrote:
> This isn't a new thing, stealing CPU cycles this way is known for some
> time now. The following are the reasons I guess why this isn't
> feasible:
>
> 1. No anonymity. The code is directly visible to the victim.

It is, however, entirely possible to obfuscate JavaScript, or to hide
the data being processed by fetching it post-load.

> 2. As long as any script is running, the browser shows that the page
> is still being loaded. This might drag suspicion to view whats in the
> page or the user might simply cancel loading (ie the java script).
> Time consuming scripts might have less chances.

Canceling loading (e.g., hitting the "stop" button in most modern
graphical desktop browsers) doesn't cancel script execution.

> 3. There are many better ways for a determined CPU thief. For example,
> there are plenty of vulnerable machines connected to Internet offering
> their everything to hackers in a silver plate.

Agreed.

> 4. If CPU cycles were really in huge demand, some one could just start
> a business offering to pay for in return to lending idle CPU. Guess
> not a bad idea ;-)

This is not a new idea - there are already several companies doing
exactly this sort of distributed computing-for-hire. United Devices,
for example.

--
antispam news, solutions for sendmail, exim, postfix: http://enemieslist.com/