/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

4,200+ websites, including USCourts.gov, UK's NHS services, other government sites were infected with cryptocurrency mining malware via hacked plugin

Biz scrambles to shut down crafty coin crafting operation  —  Thousands of websites around the world - from the UK's NHS and ICO …

The Register Chris Williams

Discussion

  • @zittrain Jonathan Zittrain on x
    You'd think you could trust the web site of, say, the U.S. court system. But it and thousands of other sites have been infected by drawing from third-party libraries on the fly — ready to use visitors' PC power to mine cryptocurrency: http://scotthelme.co.uk/... @scott_helme
  • @troyhunt Troy Hunt on x
    Statement from @texthelp on the compromise of their script (which was then embedded into a heap of other sites) http://www.texthelp.com/...
  • @mor10 Morten Rand-Hendriksen on x
    Two immediate thoughts: 1. Site owners + devs have a duty of care to end-users to protect from or clearly disclosing cryptocurrency mining scripts. 2. The service at the heart of all this needs #ethics review + independent audit. http://scotthelme.co.uk/... @scott_helme
  • @hrbrmstr @hrbrmstr on x
    Why pwn thousands of sites directly when you can pwn the JS CDN they rely on? // Protect your site from Cryptojacking with CSP + SRI http://scotthelme.co.uk/...
  • @scott_helme Scott Helme on x
    I've written up the story surrounding the cryptojacking problems we've seen hit thousands of sites today: http://scotthelme.co.uk/...
  • @scott_helme Scott Helme on x
    The script tags on http://scotthelme.co.uk/, http://report-uri.com/ and http://securityheaders.io/ all have the integrity attribute on them. You don't want your CDN to be able to compromise you like this. Go and enable SRI and enforce it with CSP. http://scotthelme.co.uk/...
  • @troyhunt Troy Hunt on x
    Gov website crypto miner issue was supply chain compromise. Lack of web security fundamentals (SRI & CSP) made it possible. Was literally “let an external partner run anything on our site & don't tell us when it goes wrong”. Here's @Scott_Helme's writeup: http://scotthelme.co.uk/…
  • @scott_helme Scott Helme on x
    Here's a list of 4,275 sites that are most likely *all* victims: https://publicwww.com/... ealoud.com%2Fplus%2Fscripts%2Fba.js/ ... These sites have neglected to deploy SRI and CSP, which would have completely mitigated this attack.
  • @charlesarthur Charles Arthur on x
    Holy heck this thread. Javascript cryptominers all over the shop. http://twitter.com/...
  • @scott_helme Scott Helme on x
    Let's also clear something else up: As terrible as it is that a crypto miner was injected into all of these sites, in reality, this could have been catastrophically worse. Key loggers, malware, DDoS scripts, BeEF hooks, or, all of the above and more...