Incident: Crypto-Mining Malware Attack on Government Websites via Browsealoud Plugin

Published Date: 2018-02-11

Postmortem Analysis
Timeline 1. The software failure incident of hackers hijacking government websites to mine cryptocurrency happened in February 2018 [68201].
System 1. Browsealoud plug-in [68201] 2. Coinhive program [68201]
Responsible Organization 1. Hackers were responsible for causing the software failure incident by injecting crypto-mining code into the Browsealoud plug-in used by various websites, including government ones [68201].
Impacted Organization 1. Information Commissioner's Office (ICO) [68201] 2. Student Loans Company 3. Barnsley Hospital
Software Causes 1. Malicious code injected into the Browsealoud plug-in used by websites, including the ICO's, to mine cryptocurrency [68201].
Non-software Causes 1. The hack occurred due to hackers exploiting a vulnerability in a website plug-in called Browsealoud, used to assist blind and partially sighted individuals in accessing the web [68201]. 2. The hackers injected malicious code into the Browsealoud plug-in, affecting not only the ICO website but also thousands of other websites that utilized the same plug-in [68201]. 3. The attack was facilitated by the insertion of crypto-mining code into the affected websites, leading visitors' computers to unknowingly mine cryptocurrency for the hackers [68201].
Impacts 1. The software failure incident led to hackers hijacking government websites, including the Information Commissioner's Office (ICO), to mine cryptocurrency, specifically Monero, using visitors' computers without their knowledge [68201]. 2. More than 4,000 websites, including government ones, were affected by the malicious code injected into the Browsealoud plug-in, causing visitors' computers to run processor-intensive calculations for cryptocurrency mining [68201]. 3. The incident resulted in the affected websites, such as the ICO, being taken down temporarily to address the issue and disable the malicious code, ensuring visitors were no longer at risk [68201]. 4. The software failure incident highlighted the increasing trend of hackers using crypto-mining code injections into websites to exploit visitors' computer processing power for financial gain, potentially causing computers to run much more slowly [68201]. 5. While the attack did not cause data loss or system damage, it raised concerns about potential risks such as personal data extraction, information theft, or malware installation, limited only by the hackers' intentions [68201].
Preventions 1. Regular security audits and vulnerability assessments of website plug-ins and third-party software like Browsealoud could have helped detect and prevent the malicious code injection [68201]. 2. Implementing strict access controls and monitoring mechanisms to prevent unauthorized tampering with website plug-ins and scripts could have mitigated the risk of such attacks [68201]. 3. Educating website administrators and users about the risks of crypto-mining malware and the importance of keeping software up to date with security patches could have increased awareness and prevented similar incidents [68201].
Fixes 1. Disabling the affected code and plug-in: The affected code and plug-in, Browsealoud, which was tampered with to mine cryptocurrency, have been disabled to prevent further exploitation [68201]. 2. Conducting a security review: Texthelp, the company responsible for the compromised plug-in, is commissioning a security review by an independent consultancy to assess and enhance data security measures [68201]. 3. Implementing data security action plan: Texthelp mentioned that they had been preparing for such incidents and immediately activated their data security action plan in response to the attack [68201]. 4. Taking affected services offline: The affected service, including the ICO website, was taken offline to mitigate the issue and prevent further exploitation by the malware [68201].
References 1. Security researcher Scott Helme [68201] 2. Information Commissioner's Office (ICO) [68201] 3. Texthelp (company which makes the plug-in) [68201] 4. Martin McKay, chief technical officer of TextHelp [68201] 5. National Cyber Security Centre spokesman [68201]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident of hackers hijacking websites to mine cryptocurrency has happened again at the Information Commissioner's Office (ICO) website. The incident involved malicious code injected into the Browsealoud plug-in used by the ICO website, affecting thousands of other websites as well [68201]. (b) The software failure incident of hackers injecting crypto-mining code into websites has also occurred at other organizations besides the ICO. The hacked script was found running on the site of the Student Loans Company, Barnsley Hospital, and other websites in the UK and worldwide [68201].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase was due to the injection of crypto-mining code into websites through a compromised website plug-in called Browsealoud, which was used to assist blind and partially sighted individuals in accessing the web. This malicious code was designed to generate cryptocurrency, specifically Monero, by running processor-intensive calculations on visitors' computers without their knowledge [68201]. (b) The software failure incident related to the operation phase was caused by hackers hijacking government websites, including the Information Commissioner's Office (ICO) website, to mine cryptocurrency. Visitors to these websites had their computers taken over to mine cryptocurrency, impacting the performance of their systems and potentially exposing them to security risks [68201].
Boundary (Internal/External) within_system (a) within_system: The software failure incident was caused by hackers injecting crypto-mining code into a website plug-in called Browsealoud, which was used to assist blind and partially sighted individuals in accessing the web. This malicious code was designed to generate cryptocurrency (Monero) by running processor-intensive calculations on visitors' computers. The plug-in was tampered with to include a program, Coinhive, for mining Monero, affecting thousands of websites, including government ones like the Information Commissioner's Office (ICO) website [68201]. (b) outside_system: The software failure incident was initiated by hackers external to the system who injected the malicious crypto-mining code into the website plug-in. The hackers exploited vulnerabilities in the plug-in to hijack visitors' computers for mining cryptocurrency without their knowledge. This external attack led to the compromise of multiple websites, demonstrating the impact of threats originating from outside the system on software failures [68201].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Article 68201 was due to non-human actions. Hackers injected malicious code into a website plug-in called Browsealoud, which was used to assist blind and partially sighted individuals in accessing the web. This injected code was designed to mine cryptocurrency, specifically Monero, by running processor-intensive calculations on visitors' computers without their knowledge [68201]. (b) The incident was also influenced by human actions. The hackers took deliberate actions to tamper with the Browsealoud plug-in, inserting the Coinhive program to mine for Monero. Additionally, the affected company, Texthelp, confirmed that the product was impacted by malicious code for four hours, indicating a human element in the software failure incident [68201].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurred due to hardware factors as hackers inserted software into websites, including government ones, to utilize visitors' computers for mining cryptocurrencies. This process requires significant computer processing power, leading to increased electricity bills. The malware injected into the websites caused visitors' computers to work on mining cryptocurrencies without their knowledge, impacting the performance of the computers [68201]. (b) The software failure incident also had contributing factors originating in software. The incident involved the tampering of a website plug-in called Browsealoud, which was used to assist blind and partially sighted individuals in accessing the web. The plug-in was affected by malicious code designed to generate cryptocurrency, specifically Monero. This tampering with the software plug-in led to the mining of Monero on visitors' computers, impacting thousands of websites that used the plug-in [68201].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was malicious. Hackers hijacked government websites, including the Information Commissioner's Office (ICO) website, to mine cryptocurrency by injecting malicious code into a website plug-in called Browsealoud. This code was designed to generate cryptocurrency (Monero) by running processor-intensive calculations on visitors' computers without their knowledge [68201]. The attack was intentional and aimed at exploiting visitors' computer resources for financial gain.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was due to poor_decisions. The incident involved hackers injecting crypto-mining code into a website plug-in called Browsealoud, which was used to assist blind and partially sighted individuals in accessing the web. This malicious code was designed to generate cryptocurrency (Monero) by running processor-intensive calculations on visitors' computers without their knowledge [68201]. The compromised plug-in affected not only the ICO website but also thousands of other websites that utilized it. This act was described as a serious breach with the potential for extracting personal data, stealing information, or installing malware, showcasing the negative consequences of the poor decision to tamper with the plug-in [68201].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 68201 was not due to development incompetence but rather due to hackers exploiting a vulnerability in a website plug-in called Browsealoud, which was used to help blind and partially sighted people access the web. The hackers injected malicious code into the plug-in, causing visitors' computers to mine cryptocurrency without their knowledge [68201]. (b) The software failure incident in Article 68201 was accidental in nature as it was caused by hackers injecting malicious code into the Browsealoud plug-in, which was not intended by the developers of the plug-in or the affected websites. The incident was not a result of intentional actions by the developers or the organizations using the plug-in but rather a malicious attack that occurred without their knowledge [68201].
Duration temporary The software failure incident reported in the articles was temporary. The incident involved hackers injecting crypto-mining code into websites, including government ones, through a compromised website plug-in called Browsealoud. The affected code was disabled, and visitors were no longer at risk after the issue was identified and resolved [68201]. The incident lasted for about four hours, during which the malicious code was active on the affected websites [68201].
Behaviour omission, value, other (a) crash: The software failure incident in the articles did not involve a crash where the system loses state and stops performing its intended functions. The incident was related to hackers injecting crypto-mining code into websites, causing visitors' computers to mine cryptocurrency without their knowledge [68201]. (b) omission: The software failure incident can be categorized under omission, as the system omitted to perform its intended functions by allowing hackers to inject malicious code into the websites, leading to unauthorized cryptocurrency mining on visitors' computers [68201]. (c) timing: The software failure incident was not related to timing issues where the system performs its intended functions but at the wrong time. Instead, the incident involved the system being compromised by hackers to conduct cryptocurrency mining activities on visitors' computers [68201]. (d) value: The software failure incident falls under the category of value, as the system performed its intended functions incorrectly by allowing unauthorized cryptocurrency mining to take place on visitors' computers due to the injection of malicious code by hackers [68201]. (e) byzantine: The software failure incident did not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The incident primarily involved the injection of crypto-mining code by hackers into websites, leading to unauthorized mining activities on visitors' computers [68201]. (f) other: The software failure incident can be categorized as a security breach and a form of cyber-attack, where hackers exploited vulnerabilities in the system to inject malicious code for cryptocurrency mining purposes. This behavior is not explicitly covered in the options provided [68201].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving hackers hijacking government websites to mine cryptocurrency impacted visitors' computers by using their processing power to mine Monero. This unauthorized mining activity could have potentially led to the extraction of personal data, stolen information, or installation of malware on the affected computers [68201]. The incident resulted in a breach that affected thousands of websites, including government ones, leading to a significant impact on users' computers and potentially their data and privacy.
Domain information, government (a) The failed system was intended to support the information industry. The incident involved hackers hijacking government websites, including the Information Commissioner's Office (ICO) website, to mine cryptocurrency [68201]. The affected code was traced back to a website plug-in called Browsealoud, which is used to help blind and partially sighted people access the web [68201]. The plug-in was tampered with to add a program, Coinhive, which mined for Monero by running processor-intensive calculations on visitors' computers [68201].

Sources

Back to List