The project is based on following the papers from 2018 IEEE workshops and conferences. We have also used some work from 28th USENIX Security symposium.
This project outline vulnerabilities in browsers which takes advantage of user-end attack surfaces in order to evade both observational and heuristic detections users and modern browsers respectively use to detect cryptojacking. While browsers have made steps toward increased security in extensions, one of the most insecure areas of modern browsers, user-script type extensions still show great vulnerabilities to XSS attacks, including cryptojacking. This spawns from a lack of certification and a decentralization of user-script distribution, despite the extensions themselves being certified by browser extension marketplaces. The project takes both an offensive and defensive stance, providing research from both angles. It demonstrates the implementation of a cryptojacking attack through exploiting user-script vulnerabilities in browsers, and what steps could be taken to defend against such.
Repository includes all the related work. Also read the paper and slides to see the workings of project.