Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack • Scott Helme • GOTO 2023

This presentation was recorded at GOTO Copenhagen 2023. #GOTOcon #GOTOcph https://gotocph.com Scott Helme - Security Researcher, Hacker & Founder of Report URI & Security Headers @ScottHelme RESOURCES https://twitter.com/Scott_Helme https://linkedin.com/in/scotthelme https://scotthelme.co.uk https://github.com/ScottHelme ABSTRACT I uncovered and investigated one of the largest Cryptojacking attacks ever seen, which impacted more than 5,000 websites that we know of. The attack also affected Government Websites all around the World, from the USA to Australia. For such a potentially devastating attack, we're lucky that all the hackers decided to do was mine Cryptocurrency. Just think of all the really evil things that are possible if you were to infect a website with malicious JavaScript. What would you do? In this talk I'll walk you through the discovery and investigation of the attack, look at how Governments around the World handled their remediation poorly, and discuss how you can stop your website becoming the victim of similar attacks that continue to this day. [...] TIMECODES 00:00 Intro 00:55 Beginning 02:57 Coinhive 06:05 Investigation 09:48 Malicious JavaScript 16:06 http://scotthel.me/gov-crypto-dork 23:12 TV episode 29:41 Subresource integrity 33:54 Benefits 35:25 Drawbacks 37:34 Content security policy 41:30 Violation report 43:39 Magecart 44:44 Notable Magecart attacks 46:20 Taxonomy of an attack 47:57 Outro Download slides and read the full abstract here: https://gotocph.com/2023/sessions/2907 RECOMMENDED BOOKS Andy Greenberg • Tracers in the Dark • https://amzn.to/3Sg3Ncz Andy Greenberg • Sandworm • https://amzn.to/4bcuUhx Andy Greenberg • This Machine Kills Secrets • https://amzn.to/3ubqV45 Thomas J. Holt, Adam M. Bossler & Kathryn C. Seigfried-Spellar • Cybercrime and Digital Forensics • https://amzn.to/3vRLe73 https://twitter.com/GOTOcon https://www.linkedin.com/company/goto- https://www.instagram.com/goto_con https://www.facebook.com/GOTOConferences #Cryptojacking #CryptoHeist #CyberSecurity #Security #Hacking #Chainalysis #Ransomeware #Programming #SoftwareEngineering #Coinhive #MaliciousJavaScript #Subresource #Magecart #Monero #ScottHelme Looking for a unique learning experience? Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech Sign up for updates and specials at https://gotopia.tech/newsletter SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily. https://www.youtube.com/user/GotoConferences/?sub_confirmation=1