3

I'm a markdown fan, and there is a very useful tool named Typora (It is free but not open source).

When I went to its official website to download it, there was neither animation nor complicated service. However my cooling-fans on my computer ran in full-speed when I visit this site. And when I open the task manager I saw a whole core are eaten up. What does this website do? Is there a bitcoin miner in JavaScript included in the source code?

In addition, does Typora itself have the same kind of problems?

Are there any useful tools to analyze the behavior of a certain website or a software?

migrated from security.stackexchange.com Mar 7 '18 at 15:52

This question came from our site for information security professionals.

  • 2
    Many websites just use really, really crappy code that burns through cycles far more than they should. Bing Images comes to mind. It's not necessarily a miner just because it eats your cycles. Most browsers can do analysis on the performance of various web pages via their developer tools. Try that. – forest Mar 2 '18 at 3:34
7

I tried to access this site in my VM found the same issue. The Typora website is running the below script:

<script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-54f423356e25706b" async="async"></script>

Typora is also using the below scripts without caching, so that it can avail the latest of resources:

https://m.addthisedge.com/live/boost/ra-54f423356e25706b/_ate.track.config_resp
https://s7.addthis.com/js/300/addthis_widget.js

I blocked addthis.com and addthisedge.com using hosts file in C:\Windows\System32\drivers\etc. It is the file used to map domain name to IP. I pointed these domain to my local random IP. After that, site does not able to find scripts and failed to execute.

What is addthis.com? According to The Guardian it is a social sharing tracker. I found that it tried to read data from other sites which I was using at that time.

After blocking these sites, CPU use is normal.

  • Thanks, It help me a lot, however, will addthis.com get information of my account name or password of the other site? – Sajoi8 May 16 '18 at 14:40
3

Most web browsers come with a build-in development tool called a "Profiler". This tool can be used to identify which javascript functionality from a website consumes how much processing time. Development tools are usually accessed with F12.

Using it on that website confirms the answer by again. Most processing time is used by the script https://s7.addthis.com/js/300/addthis_widget.js (by the function i._handleScroll, to be specific). The script is minified, so I don't really feel like doing more research into what it is actually doing. Either that script is just that awful, or the developer of the website made a mistake when they integrated that script into their website. Anyway, this is not for you to fix. You could block that script using noscript or by blacklisting the whole domain in hosts, but it is possible that the website won't work correctly anymore if you do that.

By the way: Websites using their visitors' processing power to mine Bitcoins or other cryptocurrency is actually a thing. I have seen such websites myself. But they will usually not use the CPU. They will use the visitor's GPU through the WebGL API. That means your GPU fans will start to spin, but the CPU usage in the task manager will stay rather moderate. If you want to check the current load of your GPU, check the website of the vendor. They often offer companion programs for their drivers which show such information.

  • How can I block the WebGL API in my browser? Because there is no chance for me to use GPU on browser.(I use HTML5 player to watch video on website). – Sajoi8 May 16 '18 at 14:51
  • @RoseKent Please ask this as a new question. Remember to state which browser you are using. Not every browser will have this setting in the same place (if at all). And by the way, WebGL doesn't have anything to do with video playback. It's for 3d graphics... and bitcoin mining... but mostly 3d graphics. – Philipp May 16 '18 at 15:04
  • I post it there superuser.com/questions/1323271/… . Welcome to pay attention. Thanks! – Sajoi8 May 16 '18 at 15:52
1

Depends on your browser. On Firefox, you could install NoScript and whitelist JS for that site selectively, perhaps it's a particular JS resource that is not strictly needed to view Typora itself.

Ghostery may also be able to do that on Chrome, though I have a lot less experience with what it does, it's much more automated than Noscript.

Warning: I like NoScript, but it can get a little paranoid about things and you need to do a lot of handholding to whitelist. Best to have a different browser without it available as well.

Update: yes, a major hog it is. Firefox shows a FirefoxCPWebContent at 170% on my macs Activity Monitor. And that's with all the site's JS disabled. Looks like they goofed up the code something fierce - there are a lot of open handles to fonts for that subprocess.

Bottom line: even NoScript can't fix this.

  • Noscript can whitelist fonts which may help. – forest Mar 2 '18 at 4:43
  • hmmm. maybe. Pre-57/Quantum, NoScript could also lookup info about websites from various web trust registries. The UI still shows that option, but it's not doing it. – Italian Philosopher Mar 2 '18 at 4:48
  • 2
    Just fyi: Ghostery had some privacy issues in the past (and possibly still has some). – Tom K. Mar 2 '18 at 8:23
  • 2
    @TomK. It still has those issues (unless it changed very recently). It sells user behavior information to advertising companies. – forest Mar 2 '18 at 10:21
  • chrome lets you block scripts on a per-site basis, much more convenient than a script-domain basis like no-script. just click the URL badge, choose "site settings" and change Javascript to "Block". it used to be right there in the drop down, now its a new tab, but still effective. kills most ad block blockers too! you can make Block default and reverse the above for mis-click protection/paranoia alleviation. – dandavis Mar 4 '18 at 7:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.