New ‘MarioNet’ browser attack lets hackers run bad code even after users leave a web page

“Academics from Greece have devised a new browser-based attack that can allow hackers to run malicious code inside users’ browsers even after users have closed or navigated away from the web page on which they got infected,” Catalin Cimpanu reports for ZDNet. “This new attack, called MarioNet, opens the door for assembling giant botnets from users’ browsers. These botnets can be used for in-browser crypto-mining (cryptojacking), DDoS attacks, malicious files hosting/sharing, distributed password cracking, creating proxy networks, advertising click-fraud, and traffic stats boosting, researchers said.”
“MarioNet can survive after users close the browser tab or move away from the website hosting the malicious code” Cimpanu reports. “This is possible because modern web browsers now support a new API called Service Workers.”
“A service worker, once registered and activated, can live and run in the page’s background, without requiring the user to continue browsing through the site that loaded the service worker,” Cimpanu reports. “The attack routine consists of registering a service worker when the user lands on an attacker-controlled website and then abusing the Service Worker SyncManager interface to keep the service worker alive after the user navigates away. Because Service Workers have been introduced a few years back, the MarioNet attack also works in almost all desktop and mobile browsers.”
Read more in the full article here.
MacDailyNews Note: In their research paper, the academics also describe methods through which MarioNet could avoid detected by anti-malware browser extensions and anti-mining countermeasures, and also puts forward several mitigations that browser makers could take.