Cryptojacking attack hits Australian government websites

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6hI47qpr8vmhnSDvyVlmnBp0dZy6k6QJeGIwaoEw0E6xeNe9fyuQxFgqn_x02-RAw7s7NvTD9imDWO176DWcou3eIMzYEJfzRV5GNJSsW3VVmDdeya3QstIET5X0sVPfD0eJHZ55pKjQH/s1600/2018-02-12_8-48-26.png

---

This article titled “Cryptojacking attack hits Australian government websites” was written by Naaman Zhou, for theguardian.com on Monday 12th February 2018 01.48 UTC

A series of Australian government websites, including the Victorian parliament’s, have been compromised by malware that forces visitors’ computers to secretly mine cryptocurrency, as part of a worldwide security breach.

The process, known as cryptojacking, forces a user’s computer to mine cryptocurrency without their permission, generating profits for the hacker.

Related: Billions of video site visitors unwittingly mine cryptocurrency as they watch

Government websites were infected with the malware on Sunday after a browser plug-in made by a third-party was compromised. Thousands of sites, including the UK’s National Health Service, and the UK’s own data protection watchdog, were affected.

In Australia the cryptojacking attack hit the official website of the Victorian parliament, the Queensland Civil and Administrative Tribunal, the Queensland ombudsman, the Queensland Community Legal Centre homepage, and the Queensland legislation website, which lists all of the state’s acts and bills.

Hey @troyhunt, even you’re hit down under… pic.twitter.com/oOj98Gkztn

— Scott Helme (@Scott_Helme) February 11, 2018

Hackers exploited a vulnerability in the popular browser plug-in Browsealoud, a program that converts website text to audio for visually impaired users.

The makers of Browsealoud, Texthelp, confirmed that hackers inserted a script known as Coinhive into their software. Coinhive hijacks the processing power of a user’s computer to mine the cryptocurrency Monero.

On Monday morning, Texthelp took the Browsealoud plugin offline, which meant that new visitors to the affected sites would no longer load the cryptojacking script.

On a government website we should have expected these defence mechanisms to be in place

Scott Helme, security researcher

At the time of publication on Monday, the Queensland legislation website had taken the further step of removing the Browsealoud script entirely, but it remained on the sites of the Victorian parliament, QCAT and the Queensland ombudsman.

Scott Helme, a UK-based security researcher who discovered the malware, said government websites could have done more to prevent the attack.

“When you load software like this from a third party, that third party can change it and make it do whatever they want,” he said. “There are easy ways to make sure they don’t do that.

“We don’t know how Texthelp were compromised yet, so it is hard to say whether they were really unlucky or there was some kind of inherent problem with what they were doing.

“But there were ways the government sites could have protected themselves from this. It may have been difficult for a small website, but I would have thought on a government website we should have expected these defence mechanisms to be in place.”

Helme documented the attack on his website, while Texthelp said an investigation was under way.

“The company has examined the affected file thoroughly and can confirm that it did not redirect any data, it simply used the computers’ CPUs to attempt to generate cryptocurrency,” it said.

Related: Everything you wanted to know about bitcoin but were afraid to ask

“The exploit was active for a period of four hours on Sunday. The Browsealoud service has been temporarily taken offline and the security breach has already been addressed, however Browsealoud will remain offline until Tuesday 12.00 GMT.”

Other government sites affected include Victoria’s City of Casey council, Western Australia’s City of Bayswater council, South Australia’s City of Unley council, and the office of the Queensland Public Guardian, which protects the rights of young children in care.

In December the Guardian reported that nearly 1 billion visitors to the video sites Openload, Streamango, Rapidvideo and OnlineVideoConverter were also being cryptojacked.

The office of the Queensland Parliamentary Council, which operates the Queensland legislation website, and the Victorian parliament have been contacted for comment.

guardian.co.uk © Guardian News & Media Limited 2010

Published via the Guardian News Feed plugin for WordPress.

Cryptojacking attack hits Australian government websiteshttps://goo.gl/uKf11h