I learned a little about Watering Hole Attacks, and I want to know how this attack is executed, what are methods used to achieve the goal of attacking the target, who is targeted by this attack?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Simple idea: If I can't make you go to a dangerous place, I check the "safe" places you go to and make one of them dangerous.
Attackers often spread malware by compromising websites and uploading malicious scripts to infect visitors (e.g. injecting a Flash exploit on a famous news site) - this is rarely a targeted attack. But in a watering hole attack, the adversary carefully chooses a specific website that they know their victim or group of victims visit frequently. So even if they are trained to not click on any untrusted links or to open unknown email attachments they will still eventually visit the website and get infected anyways. This way the attacker doesn't need to have the usual interaction with the victim, like sending out emails with dangerous links.
Real-life example from 2015:
A Chinese attack group infected Forbes.com back in November in a watering hole attack targeting visitors working in the financial services and defense industries, according to two security companies.
The term derives from the idea that instead of hunting their prey, predators often wait at watering holes because they know that other animals will eventually need to go there to drink.
Watering Hole is a technique used by a malicious actor to attack a group of people. The attack is targeted at a group of people who visit a common resource frequently. This could be a group of users of the same forum, workers of some company that often use some external online tool and so on...
The method of achieving this goal is by infecting the resource the targets are visiting. Thus attempting to infect the targets eventually (since they are likely to use that service again, sometime).
After the often-visited service is infected, it serves all of its clients the malicious payload - infecting them with whatever the attacker wanted to infect them. Among the infected clients, likely be the targeted group, or at least parts of it. Meaning the attack was successful, and the malicious payload got to the targets.