Watering-hole attack
Tactic in which an attacker compromises a website that the target legitimately visits, in order to infect the target unnoticed instead of attacking the victim directly.
In February 2013, Facebook, Apple and Microsoft disclosed one after another that machines used by their engineers had been infected from iPhoneDevSDK, an iOS developer forum rigged with a Java zero-day exploit. The expression watering hole borrows the image of a predator waiting for prey around a watering hole, a place every animal must pass. It appeared in security literature around 2012 and describes an indirect compromise technique that works well against targets that are hard to hit head-on, such as government agencies, defense contractors or research institutes. Their employees still visit less secure sector websites: professional forums, industry associations, standards-body sites. The attacker selects and compromises these intermediary sites, injects malicious code (a drive-by download or a browser exploit) and waits for the target to come to them. The technique is attributed notably to the APT1 and Elderwood groups, which targeted US defense contractors via subcontractor sites. It is hard to detect. The infected employee did something perfectly normal, visiting a legitimate professional site, and the infection may exploit a zero-day vulnerability that triggers no alert. For insurers, watering-hole attacks show the limits of the defensive perimeter concept. The compromise chain begins outside the insured's network, which raises questions about coverage for losses set off by third parties who are not party to the policy.
In February 2013, Apple, Facebook and Microsoft were compromised via an iOS developer forum their engineers visited regularly; Twitter, hit at the same time, was placed in the same campaign by researchers without ever confirming the entry path. The site had been booby-trapped with a Java zero-day exploit. No phishing attempt targeting employees directly had been necessary.
- Dark Reading, "Apple, Facebook Twitter Attacks: 6 Key Facts", February 2013; CSO Online (Lucian Constantin), "Many companies likely affected by compromise of popular iOS developer forum", February 2013
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.