Hola Browser Compromised in Supply Chain Attack Delivering Cryptominer

Executive Summary

A supply chain attack has compromised the Windows version of Hola Browser, a popular application with a large user base. The attack involved injecting a malicious cryptocurrency miner into the software's delivery pipeline, causing some users to unknowingly install the malware alongside the legitimate browser. The malware, identified as a Monero (XMR) miner based on XMRig, was designed to run stealthily when the infected computer was idle. Sophos and other security firms discovered the compromise during a routine certification test. Hola has confirmed the incident, stating it affected a small fraction of users (0.1%) and that they have since rebuilt their distribution infrastructure with enhanced security controls.

Threat Overview

This incident is a classic software supply chain attack, where attackers compromise the process of software creation or distribution to infect downstream users.

Technical Analysis

1. Compromise: The attackers gained access to Hola's software distribution pipeline. The exact method is not disclosed, but this could involve compromised developer credentials, a vulnerable build server, or a compromised code signing certificate.
2. Injection: The attackers injected a malicious, unsigned executable named me.exe into the installation package for Hola Browser version 1.251.91.0.
3. Installation & Persistence: When a user installed or updated to the compromised version, me.exe was also installed. The malware would then:
   • Copy itself to C:\Program Files\Hola\app\HolaMonitorService.exe.
   • Create an auto-starting Windows service named hola_monitor_svc to ensure persistence across reboots.
   • Add an exclusion for itself in Windows Defender to evade detection.
4. Execution: The malware was a Monero (XMR) cryptominer. It was configured to only activate when the computer was idle to minimize performance impact and avoid arousing user suspicion. This practice is known as cryptojacking.

Impact Assessment

While Hola claims only 0.1% of users were affected and no user data was stolen, the impact of a supply chain attack is significant:

• Erosion of Trust: A supply chain attack damages the reputation of the software vendor. Users trust that software downloaded from an official source is safe, and this incident violates that trust.
• Resource Hijacking: The cryptominer consumes the victim's CPU cycles and electricity, leading to higher energy bills, reduced system performance, and increased wear and tear on hardware.
• Potential for Further Compromise: While this payload was 'only' a cryptominer, the attackers had the ability to distribute any malware they chose, including spyware, ransomware, or banking trojans. The presence of the miner indicates a foothold that could have been used for more destructive purposes.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Security teams should hunt for signs of cryptojacking:

Detection & Response

1. Behavioral Monitoring: Use EDR solutions to monitor for signs of cryptojacking, such as sustained high CPU usage from an unsigned or unusual process. This is an application of D3-PA: Process Analysis.
2. Software Inventory: Maintain a software inventory and use it to identify all machines running the compromised version of Hola Browser.
3. Threat Intelligence: Ingest IOCs like the file names and service names associated with this attack into your SIEM and EDR to hunt for compromised systems.

Mitigation

1. M1045 - Code Signing: For software vendors like Hola, enforcing strict code signing on all binaries in the build and distribution pipeline is critical. The fact that the malicious file was unsigned was a key finding during the investigation.
2. M1038 - Execution Prevention: On the user side, application control policies that prevent the execution of unsigned executables can provide a layer of protection against such attacks.
3. Vendor Security Assessment: Organizations should consider the security practices of their software vendors as part of their procurement and risk management process.
4. Remove/Update Software: Users of Hola Browser for Windows should ensure they have updated to the latest version or consider uninstalling the software if it is not essential.