Got a question? Call 1800 853 276   |   

Criminals who take advantage of people with vision problems and well-meaning businesses are about as low as anyone can sink. The latest advisory from Stay Smart Online today tells how thousands of websites around the world which use a plugin ‘Browsealoud’ were attacked. The plugin adds speech, reading, and translation to websites facilitating access and participation for people with dyslexia, low Literacy, English as a Second Language (ESL), and those with mild visual impairments.

Over 4,200 sites, including a large number of U.S., U.K. and Australian government sites, were infected by a malicious version of Browsealoud, which caused cryptomining to run on the computers which visited the infected websites and ran the plugin, generating Monero cryptocurrency using the resources of the secondary target computers, that is, those owned by innocent people who needed the assistance of the plugin. The criminals gained financially by using the computing power of users’ PCs to generate cryptocurrency.

This technology was compromised by altering Browsealoud’s source code to silently inject Coinhive’s Monero miner into every webpage offering Browsealoud. The additional code was obfuscated or hidden by converting the ASCII (human readable) instruction to connect to Coinhive’s JavaScript miner to hexadecimal in an attempt to hide it.

Texthelp, the developers of Browsealoud, have taken action and removed the Java-based software while investigating the issue.

The Java cryptomining software is only active while browsing on an infected machine which has visited an infected web server. As soon as the web browser is closed, the software ceases to operate.

This particular attack no longer exists, but it shows the vulnerability of our free and open internet system, and the necessity of ensuring that our computer software and anti-virus is kept up to date and that your Chief Information Security Officer is aware of current issues.

There are methods we discuss on EC-Council’s Certified Ethical Hacker and Certified Network Defender courses to let web administrators know when any changes have occurred on their websites so that they would be aware that modifications have been made to their web software, that they may have been attacked and thus take action accordingly. For more information, check out our EC-Council course schedule.

References:Stay Smart OnlineThe RegisterReuters

Stay safe,Terry GriffinPrincipal Technologist: Security

Feature Articles

Our AIICT brand expands portfolio with ten new courses to help address ICT skills shortage
The Australian Institute of ICT (AIICT) has introduced a new series of industry certified bootcamp programs and nationally-recognised qualifications to meet the surging demand for skilled ICT professionals in Australia.  The bootcamps support the Morrison Government’s recently announced Digital Skills Organisation (DSO) pilot, which recognises the importance of non-accredited training to support the development of skills of the future workforce. The bootcamp programs run for six months and comprise of several vendor-specific certifications. The courses include ‘Cloud Computing Certified Professional’, ‘Certified Microsoft Full Stack Developer’, ‘Certified Artificial Intelligence Professional’, ‘Growth Marketing Professional’ and ‘Certified Project Management Professional’. The decision to introduce the bootcamps follows the VET sector’s increasing move away from nationally recognised qualifications to vendor-specific, industry-certified training. According to the National Centre for Vocational Education Research, preference for accredited training courses has declined steadily in recent years, with employers increasingly less satisfied that these courses provide their employees with the most relevant and important skills for their business. This has led many organisations to preference non-accredited training provided by private technology vendors such as Microsoft and AWS.