Official government websites in India ran crypto mining scripts without their owners' knowledge, the Economic Times reported Monday.
Municipal government websites in the state of Andhra Pradesh, among others, were infected by cryptomining software such as Coinhive, security researchers found. Users visiting these websites would then inadvertently mine cryptocurrencies on behalf of the hackers who injected the scripts in the websites originally.
The process is called cryptojacking, as the malicious scripts essentially hijack a user's computer to mine cryptocurrencies.
Security researchers Shakil Ahmed, Anisha Sarma and Indrajeet Bhuyan discovered the vulnerabilities, finding that three of sites running cryptojacking malware belonged to the ap.gov.in subdomain, which sees 160,000 hits every month, according to the report.
Bhuyan told the Times that government websites are popular targets for malicious actors, saying:
Andhra Pradesh's IT secretary did not respond to a request for comment from the Times, though the state's IT advisor to the chief minister, JA Chowdary, said "thanks for notifying us about the AP website hacking," on September 10, according to the report.
Despite acknowledging the cryptojacking malware, the websites continued to run the scripts as of September 16, the Times noted.
It is unclear how long each website ran cryptojacking software, or how much cryptocurrency was mined for the attackers.
Stone Buddha image via Shutterstock
Read more about
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.