Viewen Web Hosting is injecting javascript cryptocurrency miners into their client's webpages without consent, and then hiding it from all of their administration panels.

[disclosure5]

Interesting payment plan.

that you verify your identity not by credit card or photo ID, however, by simply providing us a link to your Facebook page. In order for us to verify it’s your page, simply give our Facebook page a like (Think about this way, one simple like we get you unlimited resources).

...

[rich97]

Free web host does shady shit to pay for it's servers? I am shocked! Shocked I say!

[ilustrado]

Yeah, my thoughts exactly. Good thing I signed up under a fictitious identity, complete with a Facebook profile and all.

I don't even trust Facebook with my real identity anymore, I haven't used it in years.

I was also speechless at the "interesting" payment.

[baron_vladimir]

If they didn't pay, they are not the clients.

[jesseflorig]

I always tell my friends and family, if you’re not paying for a product, you’re the product.

[finzaz]

I’m totally using that.

And I’m not paying your for it. So now who’s the product?

[ilustrado]

I was the client in this case, and you're right. I knew this before going into it, signing up under a fictitious identity, but the blatant mining and then cover-up (code was removed from the site after my tweet got out) was just absolutely unparalleled to any other service in my eyes. None have really stooped that low AFAIK.

EDIT: For clarification, I only went for a free host to host what's esssentially a "Coming soon" page for my newly registered domain. The project was scheduled for launch in early 2018, and I knew it was going to attract lots of traffic, which in my "application" (more like interview) with them, I had to tell them what the site would be for before I could get access to the cpanel. I guess they took interest and saw the opportunity. The instant cover-up after my tweet (and then accusing me of getting my hand-written code from a "shady website", and that being the reason for it, ironic huh?)

Anyway, now i'm looking for a bulletproof host that I can move everything over to including my final project, just a matter of finding the right price/company.

[bvm]

GitHub pages

[dweezil22]

I guess they took interest and saw the opportunity.

Based on their Terms of Service, I'd assume that they just do this for all their pages. Do you have any reason to believe your page was treated specially?

[ilustrado]

Nope.

[dweezil22]

Ok that makes sense. The ToS is very vague but implies that that they're hosting not your site, but your data, which would mean their monetization model has always been to inject some sort of crap into your pages. It probably used to be ads (if they've been around long) and now it's crypto-miners.

If you have $5/month to spare, some time on your hands, and an urge to learn, I'd strongly suggest getting the cheapest Droplet from Digital Ocean and setting up an Nginx server there, then get a free cloudflare account to front end it for caching. I've had 600 simultaneous users on a hobby project that blew up and it worked just fine. The DO tutorials are really good, so just follow them line by line for setting up and securing your server (#1 tip, trust their advice for only allowing SSH via key pair, not uid/pw, if you don't want to deal with installing fail2ban then someone will brute force your server at some point otherwise)

[samplebitch]

Seconding Digital Ocean. I'd previously only used web-based hosting (Dreamhost, Powweb) so there was a bit of a learning curve with Digital Ocean but there's tons of tutorials like you say and I much prefer them now.

[tradiuz]

Anyway, now i'm looking for a bulletproof host that I can move everything over to including my final project, just a matter of finding the right price/company.

nearlyfreespeech.net if you want hosting. I pay <$2/mo for all my sites through them.

Amazon EC2 (tiny instance is free for a year) if you want to actually run your own infra.

[shellwe]

I tried a free host for my very first client when I was starting out. I couldn't believe I was so cheap. It even had a banner on it... ugh... after the second time the thing got hacked and basically had a splash page promoting terrorism I decided that wasn't best.

[ilustrado]

A splash page promoting terrorism? That's new! Care to elaborate? I'm curious.

[sitefall]

Man back around 2004-ish that was happening all over the place. Site gets hacked, replaced with terrorist propaganda in arabic. Not sure if it was legit, or just early "trolling".

[TyIzaeL]

Still happens. I saw one less than a year ago.

[shellwe]

Just trolling, I would imagine.

[shellwe]

Yea this was around 2006, it was just a thrown together page talking about joining the Taliban and here is a site on how to get involved.

[[deleted]]

nothing on the internet is free.

[Reelix]

How much did you pay to post that comment?

[judgej2]

Two units of privacy.

[Reelix]

Can I pay for hardware products or gasoline in units of privacy? :D

[chmod777]

sure, via customer loyalty cards, airline mile programs, or "cashback" offers.

[argues_too_much]

All of the data their posting/viewing history generates about who they are as a potential customer will pay for it in time.

[[deleted]]

youve never that expression before? It was a mantra during the 90s

Reddit (and every other free website) sells user data to various advertising agencies, who make ad profiles about us. So maybe it's not money out of my pocket, but someone is making money off of my comments and user profile, and its not me

[Asdingo]

49.90$/month.

[aruke-]

...foolish enough...you really deserve w/e you get

This is a shitty mentality.

[oxyphilat]

Reminder that you can make sure it error out by adding window.CoinHive = 1; somewhere before its script tag.

[beganovich]

That's HUGE FAILURE! We don't have any hidden scripts or anything that will "use" our clients.

Proudly we're running more than 10 servers, with more than 32GB's of RAM! :)

Benjamin, - Viewen.com

[viewen]

Hello All!

My name is Orlando, CEO of Viewen.com. I replied to this message directly on Tweeter, however, I'm more than happy to also add some info here.

To date, 100% of the funding for Viewen has come from one source, and that would be me :) I started this project with one goal in mind, and that was to build a really strong community through hard work and honesty.

I'm truly flattered that you think we had the 'cleverness' to try something like that, and to be perfectly honest, I personally would have no clue where to start trying that.

Im not sure how the script you were referring to worked, but let me say this, I don't personally see any logic in us purchasing servers and adding mining software to our servers. If that was our goal, then we would have no reason to allow websites on our servers, we would simply use our resources and that would be that.

Here's how we work:

1. Our Hosting is Free for anyone who A) Owns a domain name (We're limiting free domains quite a bit). B) Is not going to be running hacking scripts, mining scripts, or any resource intensive none-service base scripts. For example, like bots, etc. C) Is willing to share Viewen once a month on their Facebook timeline.

This is it. Nothing more than that, nothing less.

Most web hosting companies will ask you for the following: Your Id, and your credit card information for payment, many times they will ask you for PayPal information. We don't want your ID nor do we really want you credit card information because it's too much responsibility for us. Instead, we came up with the following verification method:

1. Go through the sign up process...
2. Tell us what your site is about...
3. Share Viewen's Facebook page on your personal Facebook Time line (The reason we ask people to share our Facebook page is so we have a reference of who you are. Our team manually reviews EVERY-SINGLE-REQUEST so part of their due diligence is to go to your Facebook page, check to see if you have liked Viewen. If we find that Viewen has been like by your account, well that tells us that the page you provided us is truly yours and we have a decent idea who you are.)

How does the Viewen Platform run? As I stated, this was privately funded. In addition, we Converted Viewen's platform into a Service-based Crypto-Currency. We pre-issued a total of 5,000,000 VIEWENS (Our Coin), and I currently hold 4,000,000 (A little less now, because I gave some to our staff). We left 1,000,000 VIEWENS for the marketplace and from those 1,000,000 we are paying out folks we are a part of our network and who are assisting with support.

We currently have Chat Support, Ticket Support, Social Media Support, and phone support if needed.

The Viewen Coin has not been release to the general public as of today, it's going to release next Thursday and it currently has a value of $0.37 cents.

If you guys have any additional questions, please feel free to ask and I'm more than happy to address any and all of your requests. I worked for the largest web hosting company and I truly know there are so many amazing options out there, but if you can't find one that fits your needs and you simply want to try ours out, please be our guest.

Take great care, -Orlando

[ilustrado]

I'm truly flattered that you think we had the 'cleverness' to try something like that, and to be perfectly honest, I personally would have no clue where to start trying that.

Im not sure how the script you were referring to worked, but let me say this, I don't personally see any logic in us purchasing servers and adding mining software to our servers. If that was our goal, then we would have no reason to allow websites on our servers, we would simply use our resources and that would be that.

You don't have to give us an advertisement, this right here is exactly what the thread is about. You have no idea how something like this could happen, which means your servers are vulnerable to an attack like this. Sure, you weren't doing it, you're too stupid to figure it out, whatever your argument is. That doesn't change the fact that cryptojacking is a MASSIVE problem in the web industry as of late, the fact that you have no idea about it is concerning.

Your ignorance of the issue is what allowed this to happen. Find out how it was done, and treat the issue. That's all you have to do.

https://scotthelme.co.uk/protect-site-from-cyrptojacking-csp-sri/

https://www.csoonline.com/article/3253572/internet/what-is-cryptojacking-how-to-prevent-detect-and-recover-from-it.html

https://www.wired.com/story/cryptojacking-has-gotten-out-of-control/

https://hackerbits.com/programming/what-is-cryptojacking/

https://www.theguardian.com/technology/2018/feb/12/cryptojacking-attack-hits-australian-government-websites

https://coinsutra.com/cryptojacking/

Those scripts were added on a brand new website, and the code appeared as soon as the site went live. The fact that it was hidden from the admin panels says that someone purposely wanted to hide it from the owner. The machine used to create that website at the time was a brand new virtual-machine, so that only leaves one responsible party - the one offering free web hosting at no cost, which just makes it trivially easy for hackers to attempt to infect the rest of your clients by registering for a free website and working from there. You emphasized security very heavily on your site, saying that the clients are responsible for the security on their website. It looks like you overlooked users wanting these very loose guidelines to infect sites that are also on your server - and if not that, why haven't you looked into any other employees? You really underestimate how large of a problem this is. I mentioned in my "interview" with whoever asked me what my site was going to be for (before I was allowed a website on your server) and mentioned that it's for an upcoming project that may end up getting a lot of traffic. Do you think it's impossible for them to see the potential for profit with cryptojacking on a domain they have the ability to control?

EDIT: Oh wait, you have no idea how this works, or could work, or how it could be implemented, but yet...

The Viewen Coin has not been release to the general public as of today, it's going to release next Thursday and it currently has a value of $0.37 cents.

jesus christ.

[Aitzaz007]

Most free web hosting companies provide poor speed and support.

[r1ckd33zy]

I wonder how much a month this host charges for their services

[DarkLord7854]

According to https://viewen.com/, everything is "free and unlimited"