There were a number of reports late last year concerning websites featuring drive-by cryptomining—a practice that uses the CPUs of visitors to surreptitiously mine crytpocurrencies. Now, it’s been discovered that thousands of sites, including many from the US, UK, and the Australian governments, were infected with the same Monero miner from Coinhive.
UK-based security consultant Scott Helme first discovered the malicious code, which was confirmed by The Register. The affected websites all ran Browsealoud—a plugin from British tech firm Texthelp that reads out websites for those with visual impairments or conditions that affect eyesight.
Browsealoud’s code had been compromised, allowing the sites to run the Javascript-powered miner. Coinhive has long said its product is a legitimate way for websites to make money and doesn’t endorse anyone using its code without first informing visitors.
“The injected mining code was obfuscated, but when converted from hexadecimal back to ASCII it spelled out the necessary magic to summon Coinhive’s stealthy JavaScript miner to the page,” writes the Register.
We still don’t know who was behind the attacks. Some of the 4200 affected sites included The City University of New York (cuny.edu), the court information portal (uscourts.gov), Lund University (lu.se), the UK’s Student Loans Company (slc.co.uk), privacy watchdog The Information Commissioner’s Office (ico.org.uk) and the Financial Ombudsman Service (financial-ombudsman.org.uk), along with several Australian government sites, including both the Queensland and Victoria parliaments.
As with most (though not all) cryptpominers, the mining process ended when users left the pages or closed their browser tab. Thankfully, the code was only active for several hours on February 11 before Texthelp disabled the plugin.
“In light of other recent cyber attacks all over the world, we have been preparing for such an incident for the last year and our data security action plan was actioned straight away,” said Texthelp's chief technology officer Martin McKay in a statement.
“Texthelp has in place continuous automated security tests for Browsealoud, and these detected the modified file and as a result the product was taken offline.”
The company added that no customer data has been accessed or lost. Further updates will be provided when the investigation has been completed.
