Hackers infiltrated analytics platform used by 2m sites to syphon Bitcoin from gate.io

“Supply-chain attack” saw more than 680,000 sites actively infected but the code only specified an address used by gate.io

Graphic of a person stealing cryptocurrency from a laptop

Hackers infiltrated an online analytics platform used by more than two million other websites over the weekend, but did so to target just one cryptocurrency exchange platform.

Malicious code injected into a StatCounter tracking script infected every site that uses the analytics service  currently 688,154  but the code itself singled out just one uniform resource identifier (URI) 'myaccount/withdraw/BTC' seemingly used by gate.io.

Gate.io is a popular cryptocurrency exchange platform valued at more than $33 million, with more than $2.8 million in Bitcoin exchanged in just the last 24 hours at the time of writing.

But findings published by ESET showed how attackers, in this "supply-chain attack", infiltrated StatCounter to intercept Bitcoin exchanges made via the platform to syphon away cryptocurrency for themselves.

StatCounter was infiltrated on 3 November, security researcher Matthieu Faou wrote, and the platform removed the infected script three days later.

Advertisement
Advertisement - Article continues below

During that time, gate.io also stopped using StatCounter's analytics service, nullifying the threat. But it is unclear how much cryptocurrency may have been stolen during the short period the infection was active.

"Even if we do not know how many Bitcoins have been stolen during this attack, it shows how far attackers go to target one specific website, in particular a cryptocurrency exchange," Faou wrote.

"To achieve this they compromised an analytics service's website, used by more than two million other websites, including several government-related websites, to steal Bitcoin from customers of just one cryptocurrency exchange website.

"It also shows that even if your website is updated and well protected, it is still vulnerable to the weakest link, which in this case was an external resource.

"This is another reminder that external JavaScript code is under the control of a third party and can be modified at any time without notice."

The hackers modified the JavaScript-written code by adding a malicious element in the middle of the script, which Faou noted as unusual given attackers generally add malicious code at the beginning, or end of a legitimate file. Code injected into the middle, however, is typically harder to detect when examined by eye.

Moreover, they registered a domain very similar to the legitimate StatCounter one, https://www.statconuter[.]com/c.php, which can also be difficult to detect by eye when scanning logs for unusual activity.

The script was specifically injected into gate.io's 'transfer' web page, where users can transfer the cryptocurrency from a gate.io account to an external Bitcoin address.

It worked by automatically replacing this destination transfer address with an address owned by attackers, with a malicious server generating a fresh Bitcoin address each time a visitor loads the malicious URL.

"On 6 November 2018, we got the notice from ESET researcher's report and the "ESET Internet Security" product that there's a suspicious behaviour in StatCounter's traffic stats service," gate.io said in a statement.

Advertisement
Advertisement - Article continues below

"We immediately scanned it on Virustotal in 56 antivirus products. No one reported any suspicious behaviour at that time.

"However, we still immediately removed the StatCounter's service. After that, we didn't find any other suspicious behaviours. The users' funds are safe."

Despite touted as a secure form of currency exchange, cited by its advocates as one of the benefits over traditional currency, Bitcoin has been dogged with several high-profile thefts and security concerns.

Malicious Bitcoin mining scripts, also known as cryptojacking, in particular, has emerged as a popular form of attack on unsuspecting web users.

Thousands of government websites, for example, were hit by a massive mining hack in February, with attackers hijacking their computer power to mine several cryptocurrencies.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/antivirus/28144/best-antivirus
antivirus

Best antivirus for Windows 10

3 Sep 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

8 Mar 2019

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/mobile/mobile-phones/354273/pablo-escobars-brother-launches-budget-foldable-phone
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019