Image
Image
You need to know when you're out of your depth. I knew a highly trusted page should not be throwing AV errors, so at first I thought it was me. I’ve seen Scott Helme present at numerous conferences, so I reached out to him. He confirmed I was seeing a malicious JavaScript that was attempting to load a cryptominer on the ICO’s website.https://twitter.com/Scott_Helme/status/962684239975272450 Helme, an information security consultant, got to work exploring what had caused ICO's website to load up a crypto-miner. He quickly discovered that the offending script for CoinHive, a popular crypto-miner which Check Point named the "most wanted" malware in December 2017, was not hosted by the ICO. Instead he traced the script back to Texthelp, a provider of software which makes websites more accessible for people with dyslexia and other reading difficulties. Here's what the security consultant found out about the infection:
If you want to load a crypto miner on 1,000+ websites you don't attack 1,000+ websites, you attack the 1 website that they all load content from. In this case it turned out that Text Help, an assistive technology provider, had been compromised and one of their hosted script files changed. The offending asset can be found here (https://www.browsealoud.com/plus/scripts/ba.js) for the duration it remains but here is the snippet that matters.Indeed, more than 4,000 websites contained the CoinHive script following the Texthelp hack. Those include City University of New York, the UK Student Loans Company, and others. After learning of the hack from Helme, Texthelp disabled its Browsealoud feature. Martin McKay, CTO and data security officer, also released a statement acknowledging the attack and reassuring customers that the incident had not affected their data. Thornton-Trump feels that all domain owners can learn something from this episode:
The aftermath of this type of supply chain cyber security problem is ever present. We have talked on how to prevent the attack; there is debate on whether Content Security Policy and/or Sub resource integrity checking would have stopped or prevented the malicious script from running. What is clear is that cyber criminals are moving hard and fast with their attack techniques and improving their abilities. Crypto-mining opens up endless possibilities of revenue if systems are insecure or even better if they are left to languish. If you're a trusted site on the internet today, all the components of your site need to be secure. If one fails, you fail. It’s your website, so it needs to be looked after and secured if you want to keep the trust of the customer.To learn more about how to prevent this type of attack, check out Helme's posting. Click here to learn how Tripwire can help your organization defend its website and other IT assets using foundation security controls.
