Make-A-Wish Foundation Website Cryptojacked Due To Old Software

Colin Muller

The website of the Make-A-Wish Foundation, a charity dedicated to fulfilling the wishes of terminally ill children, has been successfully targeted by unknown "cryptojackers," as detected by the web security company Trustwave.

Simon Kenin of Trustwave's SpiderLabs made the discovery, blaming an un-updated version of Drupal running on the site as the attack vector for the malware. Drupal is widely used open-source website backend manager software.

The attackers injected vulnerable Drupal versions with the freely available Coinhive mass-mining script. Kenin identified the Make-A-Wish attack as one of hundreds of websites that had been infiltrated by the same method and attacker, as recently as June 2018, according to badpackets.net. At that time, over 100,000 websites that had not updated their backend software had been vulnerable to exploits.

Kenin added that Make-A-Wish have updated their software and closed off the vulnerability, after being notified.

Crypto and Security

Cryptojacking is a fairly new internet security concern, whereby malicious mining scripts are run by unsuspecting attack victims, whose computing resources are used to surreptitiously mine cryptocurrencies on behalf of the attackers.

The phenomenon began to take hold in 2017, crescendoing at the end of 2017 and into 2018 along with booming valuations of cryptoasset prices. CryptoGlobe has reported on the recent dip - by 26 percent in Q3 - of incidence of cryptojacking that targets individuals, with an increase in malicious targeting of businesses.

The Coinhive software mines Monero (XMR) because its Cryptonight hashing algorithm runs very well on CPUs, which makes it ideal for mass pool mining. This choice is very convenient for malicious actors, because XMR is the most valued privacy-focused cryptocurrency and has rigorous privacy features which mask transactions to a high degree. CryptoGlobe recently reported on the XMR “Beryllium Bullet” upgrade, which drastically reduced transaction file sizes of the cryptocurrency, and opened up upgrade paths for even more privacy features.

Another web security problem often associated with cryptocurrencies is the menace of ransomware - and example of which was the recent targeting of the Port of San Diego - although that has been on the wane in 2018 in favor of cryptojacking, according to some experts.

PayPal is Cautiously Optimistic About Partnership with Libra Association

  • PayPal cautious about future with Facebook's digital currency libra. 
  • Payment platform was one of the first companies to join and support the Libra Association.

Payment platform PayPal is cautiously optimistic about its relationship with Facebook’s digital currency libra, despite being the highest-profile company to join the Libra Association. 

PayPal Backs Libra Association

In June, shortly after the official unveiling of Facebook’s libra, PayPal announced an intention to join and support the Libra Association, a collection of tech and finance companies promoting the product. 

At the time, PayPal billed the digital currency as a revolutionary product for people around the world, 

We believe in democratizing participation in the digital economy for people from all walks of life, and businesses of all sizes.

However, PayPal appears cautious about its future with Facebook’s digital currency. PayPal investor relations vice president Gabrielle Rabinovitch reiterated Sept. 12 that the company is a non-binding agreement with libra, 

It's a non-binding commitment. And obviously, I think there's a lot of work to happen before we get to that point where it becomes something more than just a very exciting idea.

She added, 

The goals and ambitions of Libra are very consistent with PayPal's overall ambitions in terms of serving the underserved; democratizing access to capital. So we very much believe in the potential of Libra.

While PayPal appears optimistic about the future of libra, the digital currency has endured months of regulatory and political scrutiny concerning its release. 

Earlier in the week, senior U.S. Treasury official Sigal Mandelker told an audience in Geneva that libra would be held to the highest standard of regulatory compliance in order to combat money laundering and terrorist funding.

 

Featured Image Credit: Photo via Pixabay.com