Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites

Over 4,200 websites were infected last weekend with a tool that quietly used the computers of people visiting the sites to mine for the Monero cryptocurrency.

Unknown attackers installed the mining software by compromising a third-party browser plug-in called Browsealoud that many websites use to provide speech navigation capabilities for people who need additional support.

Scott Helme, the UK-based researcher who first reported on the campaign says it is unclear how the attackers managed to compromise Browsealoud in order to distribute the mining tool. But TextHelp, the company that provides the plug-in has taken it down, so the campaign has been effectively stopped.

"The broad takeaway from this is that sites which load content from a supplier like this are at the mercy of that supplier unless they protect themselves," Helme says.

Many of the impacted sites belonged to organizations in the UK and included those of major government organizations such as the Information Commissioner's Office, National Health Service, General Medical Council, and Student Loans Company.

Also affected were the websites of the Administrative Office of the United States Courts, the Indiana government, and the Cook County Treasurer's office in Illinois.

According to Helme, the attackers altered the Browsealoud Javascript Library so it added a Coinhive Monero cryptocurrency miner to any page that loaded the plug-in. A majority of sites using the plug-in appear to belong to government organizations based on the list of affected websites, Helme says.

The campaign is the latest to highlight the trend by threat actors to hijack computers and use them to mine for various cryptocurrencies. Mining tools like Coinhive are designed to use a computer's resources to verify blockchain transactions. Many people voluntarily install such mining software and allow their computers to be used as part of a wider pool of systems for cryptocurrency mining. In return they get paid in digital coins. 

Threat actors have latched on to crypto mining as a way to make quick and safe money. Instead of infecting computers to steal data or to extort money from victims, a growing number of attackers have begun hijacking computers and quietly putting them to use in crypto currency mining. In other cases, attackers install the mining tools on websites and hijack the resources of anyone using those sites.

Victims often don't realize their computers are being used for the purpose and most of the mining software itself is legitimate and therefore not always flagged as malicious or unwanted. Researchers at Cisco's Talos security unit recently estimated that an attacker using a botnet of 2,000 hijacked computers can earn upwards of $180,000 a year from cryptocurrency mining.

Organizations can relatively easily protect their websites from being compromised by third-party plug-ins and content by implementing Content Security Policy (CSP) and Subresource Integrity (SRI) says Helme. "[These] are two mechanisms that allow a site to control which other sites are allowed to load content into their pages and what content they're allowed to load," he says.

For instance "browsealoud.com" could be in the list of allowed sites but "coinhive.com" wouldn't be, so the Coinhive script wouldn't be loaded, Helme notes.

"SRI allows you to check a file by adding an integrity attribute, sometimes called a fingerprint," Helme said. "If the file changes, the fingerprint changes and we can detect that."

In the present instance, such an integrity check would have detected the change in the Browsealoud script and prevented it from loading. Admins can also use CSP to require that all scripts on the page have SRI enabled, so no checks are missed. "Coupled together, these are the perfect pair," Helme says.

"These would have helped the affected sites and would have prevented the infected file from being loaded."

Related content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.