Attacks/Breaches

2/12/2018
05:23 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites

Victims include UK's ICO, and National Health Service and USCourts.gov.

Over 4,200 websites were infected last weekend with a tool that quietly used the computers of people visiting the sites to mine for the Monero cryptocurrency.

Unknown attackers installed the mining software by compromising a third-party browser plug-in called Browsealoud that many websites use to provide speech navigation capabilities for people who need additional support.

Scott Helme, the UK-based researcher who first reported on the campaign says it is unclear how the attackers managed to compromise Browsealoud in order to distribute the mining tool. But TextHelp, the company that provides the plug-in has taken it down, so the campaign has been effectively stopped.

"The broad takeaway from this is that sites which load content from a supplier like this are at the mercy of that supplier unless they protect themselves," Helme says.

Many of the impacted sites belonged to organizations in the UK and included those of major government organizations such as the Information Commissioner's Office, National Health Service, General Medical Council, and Student Loans Company.

Also affected were the websites of the Administrative Office of the United States Courts, the Indiana government, and the Cook County Treasurer's office in Illinois.

According to Helme, the attackers altered the Browsealoud Javascript Library so it added a Coinhive Monero cryptocurrency miner to any page that loaded the plug-in. A majority of sites using the plug-in appear to belong to government organizations based on the list of affected websites, Helme says.

The campaign is the latest to highlight the trend by threat actors to hijack computers and use them to mine for various cryptocurrencies. Mining tools like Coinhive are designed to use a computer's resources to verify blockchain transactions. Many people voluntarily install such mining software and allow their computers to be used as part of a wider pool of systems for cryptocurrency mining. In return they get paid in digital coins. 

Threat actors have latched on to crypto mining as a way to make quick and safe money. Instead of infecting computers to steal data or to extort money from victims, a growing number of attackers have begun hijacking computers and quietly putting them to use in crypto currency mining. In other cases, attackers install the mining tools on websites and hijack the resources of anyone using those sites.

Victims often don't realize their computers are being used for the purpose and most of the mining software itself is legitimate and therefore not always flagged as malicious or unwanted. Researchers at Cisco's Talos security unit recently estimated that an attacker using a botnet of 2,000 hijacked computers can earn upwards of $180,000 a year from cryptocurrency mining.

Organizations can relatively easily protect their websites from being compromised by third-party plug-ins and content by implementing Content Security Policy (CSP) and Subresource Integrity (SRI) says Helme. "[These] are two mechanisms that allow a site to control which other sites are allowed to load content into their pages and what content they're allowed to load," he says.

For instance "browsealoud.com" could be in the list of allowed sites but "coinhive.com" wouldn't be, so the Coinhive script wouldn't be loaded, Helme notes.

"SRI allows you to check a file by adding an integrity attribute, sometimes called a fingerprint," Helme said. "If the file changes, the fingerprint changes and we can detect that."

In the present instance, such an integrity check would have detected the change in the Browsealoud script and prevented it from loading. Admins can also use CSP to require that all scripts on the page have SRI enabled, so no checks are missed. "Coupled together, these are the perfect pair," Helme says.

"These would have helped the affected sites and would have prevented the infected file from being loaded."

Related content:

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.