15 Feb Misguided Web Hack helps create a huge $24 of Monero
Over the last weekend hackers managed to inject thousands of websites—including UK and US government sites with malicious code that hijacked visitors computers to mine cryptocurrency.
The attack, noticed on Sunday by security researcher Scott Helme, was pulled off by compromising a single web site plugin that was used by all of the affected sites. Browsealoud, a reputable suite of accessibility and translation tools. According to Helme, the plugin was edited by the attackers to embed a script that uses a computer viewing an affected site to do the complex math routine that generates new digital coins (in this particular case the coin was Monero, a coin you can mine with CPU power). This process, known as “mining,” can of course slow down the victim’s computer.
The hackers behind the attack chose to mine cryptocurrency, but they had the power to do almost whatever they wanted.
They could have used their access to install a keylogger onto the victim’s computers, for example, or infected them with more invasive malware. Scott Helme was quoted as saying “The only limitation of what happened here was the attacker’s imagination”.
The hackers used the popular browser mining service Coinhive, which can be used legitimately but has also become a favourite among criminals as well. While Coinhive initially stated that the hackers had merely copied its code, on Tuesday Coinhive admitted that their service was used in the hack. “Sorry for the misinformation,” spokespeople added – In addition, Coinhive told Motherboard reporter Joseph Cox in a follow-up interview, the hackers made a grand total of $24 worth of Monero.