Friday, March 18, 2016

What is a Watering Hole Attack ?


Watering Hole Attack is an attack in which the attacker targets a particular group, such as an organization, industry or region to perpetrate the attack. The attacker first observes the visitors of the target website and the browsing habit of those visitors. And then, selectively attacks the websites that the visitors mostly visit, so that the visitors can be infected with malware and thus, impacting the actual target.


The term Watering Hole is inspired by the predators in the natural world, who wait in ambush near a watering hole, so that it can attack the desired preys in proper time. In Watering Hole Attack, the cyber attackers observe the visitors of a popular website and make attack on them just like those predators in the natural world, and hence the name Watering Hole Attack.






How is Watering Hole Attack perpetrated ?



In a Watering Hole Attack, the attackers first decide on a target website. Then, using various malicious methods, the attackers gain strategic information on how to impact the target website in a most effective way. In many cases, the attackers keep an eye on the visitors of the target website and observe what all websites those visitors mostly visit.


After that, the attackers find out what all of those websites have security vulnerabilities. And then, they use various malicious methods to attack those websites.

Most of the cases, the attackers inject malicious scripts or HTML on those vulnerable websites and redirect those visitors to a website controlled by the attackers.

Now, the attackers can spread malware to the systems of those visitors using various methods like Drive-By Downloads etc.

Many a times the attackers infect those innocent visitors with Remote Access Trojans or spyware, so that they can control their systems and spy on their behavior.


Who are targeted in Watering Hole Attack ?


Any group like an organization, industry, region or a company can be targets of this attack. The following groups are mostly targeted by the attackers :

  • Various businesses
  • Human Rights groups
  • Government Offices


Impact of Watering Hole Attack


In Watering Hole Attack, the attackers mostly infect the visitors with RATs or spyware. So, the attackers can control the systems of the visitors and spy on them. And, when these visitors visit the target website again, the attackers can monitor various activities of the target organization. And, as the attackers get control of the network of the targeted organization, they can now initiate attacks on the targeted organization, including stealing, updating or deleting sensitive files.


How to prevent Watering Hole Attack ?


Attackers mainly take advantage of security vulnerabilities of commonly used software of the target organization to perpetrate this attack. So, the best method to prevent this attack would be to update all commonly used software, including the Operating Systems, in a organization. And, firewalls should be properly configured. Organizations should monitor the inbound and outbound network traffic in an organization and implement proper security measures.


So, beware of various cyber attacks, so that you can protect your systems in a better way. And, stay safe, stay secured.


at

No comments:

Post a Comment