Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/12/2018
05:23 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites

Victims include UK's ICO, and National Health Service and USCourts.gov.

Over 4,200 websites were infected last weekend with a tool that quietly used the computers of people visiting the sites to mine for the Monero cryptocurrency.

Unknown attackers installed the mining software by compromising a third-party browser plug-in called Browsealoud that many websites use to provide speech navigation capabilities for people who need additional support.

Scott Helme, the UK-based researcher who first reported on the campaign says it is unclear how the attackers managed to compromise Browsealoud in order to distribute the mining tool. But TextHelp, the company that provides the plug-in has taken it down, so the campaign has been effectively stopped.

"The broad takeaway from this is that sites which load content from a supplier like this are at the mercy of that supplier unless they protect themselves," Helme says.

Many of the impacted sites belonged to organizations in the UK and included those of major government organizations such as the Information Commissioner's Office, National Health Service, General Medical Council, and Student Loans Company.

Also affected were the websites of the Administrative Office of the United States Courts, the Indiana government, and the Cook County Treasurer's office in Illinois.

According to Helme, the attackers altered the Browsealoud Javascript Library so it added a Coinhive Monero cryptocurrency miner to any page that loaded the plug-in. A majority of sites using the plug-in appear to belong to government organizations based on the list of affected websites, Helme says.

The campaign is the latest to highlight the trend by threat actors to hijack computers and use them to mine for various cryptocurrencies. Mining tools like Coinhive are designed to use a computer's resources to verify blockchain transactions. Many people voluntarily install such mining software and allow their computers to be used as part of a wider pool of systems for cryptocurrency mining. In return they get paid in digital coins. 

Threat actors have latched on to crypto mining as a way to make quick and safe money. Instead of infecting computers to steal data or to extort money from victims, a growing number of attackers have begun hijacking computers and quietly putting them to use in crypto currency mining. In other cases, attackers install the mining tools on websites and hijack the resources of anyone using those sites.

Victims often don't realize their computers are being used for the purpose and most of the mining software itself is legitimate and therefore not always flagged as malicious or unwanted. Researchers at Cisco's Talos security unit recently estimated that an attacker using a botnet of 2,000 hijacked computers can earn upwards of $180,000 a year from cryptocurrency mining.

Organizations can relatively easily protect their websites from being compromised by third-party plug-ins and content by implementing Content Security Policy (CSP) and Subresource Integrity (SRI) says Helme. "[These] are two mechanisms that allow a site to control which other sites are allowed to load content into their pages and what content they're allowed to load," he says.

For instance "browsealoud.com" could be in the list of allowed sites but "coinhive.com" wouldn't be, so the Coinhive script wouldn't be loaded, Helme notes.

"SRI allows you to check a file by adding an integrity attribute, sometimes called a fingerprint," Helme said. "If the file changes, the fingerprint changes and we can detect that."

In the present instance, such an integrity check would have detected the change in the Browsealoud script and prevented it from loading. Admins can also use CSP to require that all scripts on the page have SRI enabled, so no checks are missed. "Coupled together, these are the perfect pair," Helme says.

"These would have helped the affected sites and would have prevented the infected file from being loaded."

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10136
PUBLISHED: 2020-06-02
Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access cont...
CVE-2020-13757
PUBLISHED: 2020-06-01
Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing exces...
CVE-2020-13758
PUBLISHED: 2020-06-01
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVE-2020-9291
PUBLISHED: 2020-06-01
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVE-2019-15709
PUBLISHED: 2020-06-01
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.