Web miners are still seen with suspicion, as mining operations are often carried out without obtaining the consent of the users. In this opportunity, a group of North American investigators managed to detect a modality supposedly used by the government of Egypt, to mine Monero at the expense of their citizens, with an almost imperceptible method.

The study conducted by the Citizen Lab of the University of Toronto has shown that the government of Egypt could have taken advantage of the citizens of their country to mine cryptocurrencies in secret. This could have been done by a method that the researchers called AdHose.

This method would take advantage of the main telephone service company in the country called Telecom Egypt. In this network, the government could have placed deep packet inspection (DPI) middleboxes to redirect citizens’ Internet connections to advertisements that contained web mining software.

According to the study, mining with AdHose could be done in two ways, one called ‘dew’ in which users are directed to short ads and another called ‘drip’ in which it is redirected to sites that are no longer enabled. The dew mode is less used because it could be discovered more easily. However, the drip method is in continuous operation:

We found similar middleboxes at a Telecom Egypt demarcation point. The middleboxes were being used to redirect users across dozens of ISPs to affiliate ads and browser cryptocurrency mining scripts. The Egyptian scheme, which we call AdHose, has two modes. In spray mode, AdHose redirects Egyptian users en masse to ads for short periods of time. In trickle mode, AdHose targets some JavaScript resources and defunct websites for ad injection. AdHose is likely an effort to covertly raise money.

The Canadian company that developed this system is called Sandvine. The AdHose also serves as a tool of censorship to deprive citizens of different countries access to certain pages of human rights, news and politics.

In Egypt, these devices were being used to block dozens of human rights, political, and news websites including Human Rights Watch, Reporters Without Borders, Al Jazeera, Mada Masr, and HuffPost Arabic. In Turkey, these devices were being used to block websites including Wikipedia, the website of the Dutch Broadcast Foundation (NOS), and the website of the Kurdistan Workers’ Party (PKK).

The cryptocurrency that is usually mined using this method is monero (XMR), which is usually recognized for offering high levels of privacy and that in recent weeks has presented a high volatility in its price, possibly the product of an upcoming bifurcation that will give rise to the blockchain of MoneroV.

The mining of cryptocurrencies in Egypt by the Government would be quite controversial, given that last January, the first religious authority of the country rejected the use of crypto-active for the faithful because, in their opinion, cryptocurrencies are against of Muslim religious laws.