Thanks to a hacker, websites for the San Diego Zoo, the government of Chihuahua, Mexico, and PC maker Lenovo were all briefly serving cryptocurrency miners to unsuspecting visitors this past weekend.
At least 400 websites were ensnared in the hacker's campaign, according to Troy Mursch, an independent security researcher.
He's been tracking the mining, which involves siphoning away your PC's processing power to generate a virtual currency called Monero. To do so, the miner will run over your computer's internet browser when you load up the website. If enough computers are pulled into the mining, a hacker can generate a pretty penny — all at the expense of slowing down your computer's performance.
How did the miner reach so many sites? Mursch noticed that they all share one thing in common: the websites use an outdated version of the content management system Drupal, which contains a serious vulnerability that can let an attacker run malicious code over the software.
The security community has dubbed the flaw "Drupalgeddon 2," given that over 1 million websites use the content management system. The developers of Drupal have released patches, but unfortunately not everyone has installed them. After the vulnerability was made public in late March, both Drupal and security firms have been noticing hackers actively scanning websites for the flaw in apparent attempts to exploit it.
Mursch told PCMag this past weekend's cryptocurrency mining campaign appears to have taken advantage of the same flaw. "This is yet another case of miscreants compromising outdated and vulnerable Drupal installations on a large scale," he wrote in a separate blog post.
The good news is that some of the affected websites have removed the mining code after Mursch alerted them about the problem. He's uploaded a list of sites were found serving up the miner and is encouraging Drupal users to patch their systems.
To generate the virtual currency, the mysterious hacker chose to rely on a third-party service called Coinhive, which offers a cryptocurrency miner that anyone can register and use.
PCMag reached out to Coinhive about the hacking campaign, but so far the service hasn't responded for comment. Typically, Coinhive has been quick to respond to media questions about its mining software. But the service has mysteriously gone quiet since March when security reporter Brian Krebs wrote a post investigating the possible owner of Coinhive.
In response to Krebs' reporting, a developer in Germany known as Dominic Szablewski wrote a blog post, admitting to creating Coinhive. However, he later deleted the post, and has not responded to a request for comment.
In that now deleted post, Szablewski wrote: "I found a company interested in a new venture. They have taken over Coinhive and are now working on a big overhaul."