The Now And The Future Of Malicious WebAssembly
summary
A crawl of 1,000,000 sites and 3.5 million pages finds ~2,000 WebAssembly modules but only ~150 distinct binaries, with many tiny test modules and popular uses in games and the draco 3D library. Measurements show modules from 8 bytes to 20+ MB, JavaScript still dominates, yet ~900 sites with in‑browser miners appear and some actors hide payloads by splitting or obfuscating code across multiple wasm modules. Tooling uses instantiateStreaming and a custom wrapper to harvest and profile CPU usage.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:41The native Web
- 1:45WebAssembly (Wasm) Introduced March 2017
- 2:51Wasm performance
- 3:40Wasm ports
- 6:51Using Wasm modules
- 9:50Attacker models
- 12:19Crawling
- 14:33Prevalence
- 15:48Extent of usage
- 17:48Cluster analysis
- 19:03Custom, Library and Test
- 20:32Games
- 21:04Primer on mining
- 22:50Cryptojacking/ Mining
- 24:58Obfuscation
- 27:34Possible progress
- 30:11Conclusion
related talks
14mWebAssembly becoming the biggest platform
36mPractical WebAssembly
39mFast future with WebAssembly
53mWebAssembly – To the browser and beyond!
25mWebAssembly: Binary in Plain English
27mHow WebAssembly is changing the Web and what it means for you
44mWebAssembly
35mWebAssembly: now web is a new compiler target architecture