0

I learned a little about Watering Hole Attacks, and I want to know how this attack is executed, what are methods used to achieve the goal of attacking the target, who is targeted by this attack?

Thank you.

closed as too broad by Steve, Steffen Ullrich, S.L. Barth, Rory Alsop Feb 28 '17 at 19:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Information about this technique is readily available on the internet. Do you have a more specific question about this topic? Otherwise it seems too broad and asks for information that is trivial to find. – MiaoHatola Feb 28 '17 at 12:30
  • 1
    What is it about the Wikipedia definition that you need clarification about? Seems well-explained to me. – Arminius Feb 28 '17 at 12:31
  • i mean how this attack work exactly, yes i read an abstract information and some information, i want to know how this attack work @MiaoHatola – YCF_L Feb 28 '17 at 12:32
  • do you find this en.wikipedia.org/wiki/Watering_hole_attack clear enough for your @Arminius ? – YCF_L Feb 28 '17 at 12:33
2

Simple idea: If I can't make you go to a dangerous place, I check the "safe" places you go to and make one of them dangerous.

Attackers often spread malware by compromising websites and uploading malicious scripts to infect visitors (e.g. injecting a Flash exploit on a famous news site) - this is rarely a targeted attack. But in a watering hole attack, the adversary carefully chooses a specific website that they know their victim or group of victims visit frequently. So even if they are trained to not click on any untrusted links or to open unknown email attachments they will still eventually visit the website and get infected anyways. This way the attacker doesn't need to have the usual interaction with the victim, like sending out emails with dangerous links.

Real-life example from 2015:

A Chinese attack group infected Forbes.com back in November in a watering hole attack targeting visitors working in the financial services and defense industries, according to two security companies.

(Source)

The term derives from the idea that instead of hunting their prey, predators often wait at watering holes because they know that other animals will eventually need to go there to drink.

1

Watering Hole is a technique used by a malicious actor to attack a group of people. The attack is targeted at a group of people who visit a common resource frequently. This could be a group of users of the same forum, workers of some company that often use some external online tool and so on...

The method of achieving this goal is by infecting the resource the targets are visiting. Thus attempting to infect the targets eventually (since they are likely to use that service again, sometime).

Ways of infecting people through a web service are Exploit Kits, Cross Site Scripting and more.

After the often-visited service is infected, it serves all of its clients the malicious payload - infecting them with whatever the attacker wanted to infect them. Among the infected clients, likely be the targeted group, or at least parts of it. Meaning the attack was successful, and the malicious payload got to the targets.

Not the answer you're looking for? Browse other questions tagged or ask your own question.