Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/12/2018
05:23 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites

Victims include UK's ICO, and National Health Service and USCourts.gov.

Over 4,200 websites were infected last weekend with a tool that quietly used the computers of people visiting the sites to mine for the Monero cryptocurrency.

Unknown attackers installed the mining software by compromising a third-party browser plug-in called Browsealoud that many websites use to provide speech navigation capabilities for people who need additional support.

Scott Helme, the UK-based researcher who first reported on the campaign says it is unclear how the attackers managed to compromise Browsealoud in order to distribute the mining tool. But TextHelp, the company that provides the plug-in has taken it down, so the campaign has been effectively stopped.

"The broad takeaway from this is that sites which load content from a supplier like this are at the mercy of that supplier unless they protect themselves," Helme says.

Many of the impacted sites belonged to organizations in the UK and included those of major government organizations such as the Information Commissioner's Office, National Health Service, General Medical Council, and Student Loans Company.

Also affected were the websites of the Administrative Office of the United States Courts, the Indiana government, and the Cook County Treasurer's office in Illinois.

According to Helme, the attackers altered the Browsealoud Javascript Library so it added a Coinhive Monero cryptocurrency miner to any page that loaded the plug-in. A majority of sites using the plug-in appear to belong to government organizations based on the list of affected websites, Helme says.

The campaign is the latest to highlight the trend by threat actors to hijack computers and use them to mine for various cryptocurrencies. Mining tools like Coinhive are designed to use a computer's resources to verify blockchain transactions. Many people voluntarily install such mining software and allow their computers to be used as part of a wider pool of systems for cryptocurrency mining. In return they get paid in digital coins. 

Threat actors have latched on to crypto mining as a way to make quick and safe money. Instead of infecting computers to steal data or to extort money from victims, a growing number of attackers have begun hijacking computers and quietly putting them to use in crypto currency mining. In other cases, attackers install the mining tools on websites and hijack the resources of anyone using those sites.

Victims often don't realize their computers are being used for the purpose and most of the mining software itself is legitimate and therefore not always flagged as malicious or unwanted. Researchers at Cisco's Talos security unit recently estimated that an attacker using a botnet of 2,000 hijacked computers can earn upwards of $180,000 a year from cryptocurrency mining.

Organizations can relatively easily protect their websites from being compromised by third-party plug-ins and content by implementing Content Security Policy (CSP) and Subresource Integrity (SRI) says Helme. "[These] are two mechanisms that allow a site to control which other sites are allowed to load content into their pages and what content they're allowed to load," he says.

For instance "browsealoud.com" could be in the list of allowed sites but "coinhive.com" wouldn't be, so the Coinhive script wouldn't be loaded, Helme notes.

"SRI allows you to check a file by adding an integrity attribute, sometimes called a fingerprint," Helme said. "If the file changes, the fingerprint changes and we can detect that."

In the present instance, such an integrity check would have detected the change in the Browsealoud script and prevented it from loading. Admins can also use CSP to require that all scripts on the page have SRI enabled, so no checks are missed. "Coupled together, these are the perfect pair," Helme says.

"These would have helped the affected sites and would have prevented the infected file from being loaded."

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7981
PUBLISHED: 2020-01-25
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
CVE-2019-0141
PUBLISHED: 2020-01-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-7596
PUBLISHED: 2020-01-25
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
CVE-2020-7980
PUBLISHED: 2020-01-25
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
CVE-2012-6613
PUBLISHED: 2020-01-25
D-Link DSR-250N devices with firmware 1.05B73_WW allow Persistent Root Access because of the admin password for the admin account.