View source for Watering hole attack

{{Short description|Computer attack strategy}}

'''Watering hole''' is a computer attack strategy in which an attacker guesses or observes which websites an organization often uses and infects one or more of them with [[Malware|malware]]. Eventually, some member of the targeted group will become infected.<ref name=Gradigo2012>{{cite web|last1=Gragido|first1=Will|title=Lions at the Watering Hole – The "VOHO" Affair|url=https://blogs.rsa.com/lions-at-the-watering-hole-the-voho-affair/|website=The RSA Blog|publisher=EMC Corporation|date=20 July 2012}}</ref><ref name=HaasterGeversSprengers2016>{{Cite book|url=https://books.google.com/books?id=DDiOCgAAQBAJ&pg=PA57|title=Cyber Guerilla|last1=Haaster|first1=Jelle Van|last2=Gevers|first2=Rickey|last3=Sprengers|first3=Martijn|date=2016-06-13|publisher=Syngress|isbn=9780128052846|page=57|language=en}}</ref><ref name=Miller2014>{{Cite book|url=https://books.google.com/books?id=VBuDBAAAQBAJ&pg=PA123|title=Internet Technologies and Information Services, 2nd Edition|last=Miller|first=Joseph B.|date=2014|publisher=ABC-CLIO|isbn=9781610698863|page=123}}</ref> Hacks looking for specific information may only attack users coming from a specific [[IP address]]. This also makes the hacks harder to detect and research.<ref name=":1">Symantec. Internet Security Threat Report, April 2016, p. 38 https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf</ref> The name is derived from predators in the natural world, who wait for an opportunity to attack their prey near watering holes.<ref>{{Cite news|url=http://searchsecurity.techtarget.com/definition/watering-hole-attack|title=What is watering hole attack?|last=Rouse|first=Margaret|work=SearchSecurity|access-date=2017-04-03|language=en-US}}</ref>

One of the most significant dangers of watering hole attacks is that they are executed via legitimate websites that are unable to be easily blacklisted. Also, the scripts and malware used in these attacks are often meticulously created, making it challenging for an antivirus software to identify them as threats.<ref>{{Cite journal |last1=APOSTOL |first1=Mihai |last2=PALINIUC |first2=Bogdan |last3=MORAR |first3=Rareș |last4=VIDU |first4=Florin |date=2022-05-18 |title=Malicious Strategy: Watering Hole Attacks |journal=Romanian Cyber Security Journal |language=en |volume=4 |issue=1 |pages=29–37 |doi=10.54851/v4i1y202204 |issn=2668-6430|doi-access=free }}</ref>

==Defense techniques==

Websites are often infected through [[Zero-day (computing)|zero-day]] vulnerabilities on browsers or other software.<ref name=":1" /> A defense against known vulnerabilities is to apply the latest software patches to remove the vulnerability that allowed the site to be infected. This is assisted by users to ensure that all of their software is running the latest version. An additional defense is for companies to monitor their websites and networks and then block traffic if malicious content is detected.<ref name=Grimes2017>{{Cite news|url=http://www.infoworld.com/article/2614643/security/watch-out-for-waterhole-attacks----hackers--latest-stealth-weapon.html|title=Watch out for waterhole attacks -- hackers' latest stealth weapon|last=Grimes|first=Roger A.|work=InfoWorld|access-date=2017-04-03|language=en}}</ref> Other defense techniques include utilizing complex passwords and passkeys to access websites as well as biometric information to protect data from attacks. Utilizing web injections such as [[Firewall (computing)|firewalls]] or downloading [[Antivirus software|anti-virus software]] on to devices can also protect from attacks. <ref>{{Cite journal |last=Ismail |first=Khairun Ashikin |last2=Singh |first2=Manmeet Mahinderjit |last3=Mustaﬀa |first3=Norlia |last4=Keikhosrokiani |first4=Pantea |last5=Zulkefli |first5=Zakiah |date=2017-01-01 |title=Security Strategies for Hindering Watering Hole Cyber Crime Attack |url=https://www.sciencedirect.com/science/article/pii/S1877050917329708 |journal=Procedia Computer Science |series=4th Information Systems International Conference 2017, ISICO 2017, 6-8 November 2017, Bali, Indonesia |volume=124 |pages=656–663 |doi=10.1016/j.procs.2017.12.202 |issn=1877-0509|doi-access=free }}</ref>  Additionally, websites can enhance protection by disabling or removing vulnerable software, such as Flash and Adobe Reader, which are commonly targeted in cyber attacks.

==Examples==
===2012 US Council on Foreign Relations===
In December 2012, the [[Organization:Council on Foreign Relations|Council on Foreign Relations]] website was found to be infected with malware through a zero-day vulnerability in Microsoft's [[Software:Internet Explorer|Internet Explorer]]. In this attack, the malware was only deployed to users using Internet Explorer set to English, Chinese, Japanese, Korean and Russian.<ref name=Mimoso2012>{{Cite news|url=https://threatpost.com/council-foreign-relations-website-hit-watering-hole-attack-ie-zero-day-exploit-122912/77352/|title=Council on Foreign Relations Website Hit by Watering Hole Attack, IE Zero-Day Exploit|date=2012-12-29|work=Threatpost |access-date=2017-04-02|language=en-US}}</ref>

===2013 Havex ICS software supply chain attack===
Havex was discovered in 2013 and is one of five known Industrial Control System (ICS) tailored malware developed in the past decade. Energetic Bear began utilizing Havex in a widespread espionage campaign targeting energy, aviation, pharmaceutical, defense, and petrochemical sectors. The campaign targeted victims primarily in the United States and Europe.<ref>{{Cite web| url=https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01|title=ICS Focused Malware| website=ics-cert.us-cert.gov| language=en| access-date=2020-12-09}}</ref> Havex exploited supply chain and watering-hole attacks on ICS vendor software in addition to spear phishing campaigns to gain access to victim systems.<ref>{{Cite web|url=https://www.netresec.com/?page=Blog&month=2014-10&post=Full-Disclosure-of-Havex-Trojans| title=Full Disclosure of Havex Trojans|website=Netresec| date=27 October 2014|language=en|access-date=2020-12-09}}</ref>

===2013 US Department of Labor===
In mid-early 2013, attackers used the United States Department of Labor website to gather information on users that visited the website. This attack specifically targeted users visiting pages with nuclear-related content.<ref name=Cisco2017>{{Cite web|url=http://blogs.cisco.com/security/department-of-labor-watering-hole-attack-confirmed-to-be-0-day-with-possible-advanced-reconnaissance-capabilities|title=Department of Labor Watering Hole Attack Confirmed to be 0-Day with Possible Advanced Reconnaissance Capabilities|website=blogs@Cisco - Cisco Blogs|date=4 May 2013|language=en-US|access-date=2017-04-03}}</ref>

===2016 Polish banks===
In late 2016, a Polish bank discovered malware on the institution's computers. It is believed that the source of this malware was the [[Web server|web server]] of the Polish Financial Supervision Authority.<ref name=":0">{{Cite news|url=https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware|title=Attackers target dozens of global banks with new malware|work=Symantec Security Response|access-date=2017-04-02}}</ref> There have been no reports on any financial losses as a result of this hack.<ref name=":0" />

===2017 Montreal-based International Civil Aviation Organization attack===
There was an organization-level watering-hole attack in Montreal from 2016-2017 by an unknown entity causing a data breach.<ref>{{Cite web |date=2023-02-20 |title='Patient zero' in cyberattack on UN aviation agency was senior official's son, email reveals {{!}} CBC News |url=https://www.cbc.ca/news/canada/montreal/icao-patient-zero-cyberattack-whistleblower-1.5223883 |access-date=2023-12-26 |archive-url=https://web.archive.org/web/20230220231801/https://www.cbc.ca/news/canada/montreal/icao-patient-zero-cyberattack-whistleblower-1.5223883 |archive-date=2023-02-20 }}</ref>

===2017 CCleaner attack===
From August to September 2017, the installation binary of [[Software:CCleaner|CCleaner]] distributed by the vendor's download servers included malware. CCleaner is a popular tool used to clean potentially unwanted files from Windows computers, widely used by security-minded users. The distributed installer binaries were signed with the developer's certificate making it likely that an attacker compromised the development or build environment and used this to insert malware.<ref name=CiscoCcleaner2017>{{Cite news|url=http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html|title=CCleanup: A Vast Number of Machines at Risk|website=blogs@Cisco - Cisco Blogs|access-date=2017-09-19|language=en-US}}</ref><ref name=Piriform2017>{{Cite news|url=https://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users|title=Security Notification for CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 for 32-bit Windows users|website=blogs@Piriform - Piriform Blogs|access-date=2017-09-19|language=en-US}}</ref>

===2017 NotPetya attack===
In June 2017, the [[Engineering:Petya (malware)|NotPetya]] (also known as ExPetr) malware, believed to have originated in Ukraine, compromised a Ukrainian government website. The [[Attack vector|attack vector]] was from users of the site downloading it. The malware erases the contents of victims' hard drives.<ref>{{Cite web|url=https://threatpost.com/researchers-find-blackenergy-apt-links-in-expetr-code/126662/|title=Researchers Find BlackEnergy APT Links in ExPetr Code|date=3 July 2017 }}</ref>

===2018 Chinese country-level attack===
There was a country-level watering-hole attack in China from late 2017 into March 2018, by the group "LuckyMouse" also known as "Iron Tiger", "EmissaryPanda", "[[Advanced persistent threat|APT]] 27" and "Threat Group-3390."<ref>{{Cite web|url=https://thehackernews.com/2018/06/chinese-watering-hole-attack.html|title = Chinese Hackers Carried Out Country-Level Watering Hole Attack}}</ref>

=== 2019 Holy Water Campaign ===
In 2019, a watering-hole attack, called Holy Water Campaign, targeted Asian religious and charity groups.<ref>{{Cite web|title=Kaspersky uncovers a creative water hole attack discovered in the wild|url=https://usa.kaspersky.com/about/press-releases/2020_kaspersky-uncovers-a-creative-water-hole-attack-discovered-in-the-wild|website=Kaspersky|date=26 May 2021}}</ref> Victims were prompted to update [[Software:Adobe Flash|Adobe Flash]] which triggered the attack. It was creative and distinct due to its fast evolution.<ref name=":2" /> Motive remains unclear.<ref name=":2">{{Cite web|title=Holy water: ongoing targeted water-holing attack in Asia|url=https://securelist.com/holy-water-ongoing-targeted-water-holing-attack-in-asia/96311/|access-date=2020-08-05|website=securelist.com|date=31 March 2020 }}</ref> Experts provided a detailed technical analysis along with a long list of Indicators of Compromise (IoCs) involved in the campaign, but none could be traced back to an Advanced Persistent Threat.<ref>{{Cite web|title=Holy water: ongoing targeted water-holing attack in Asia|url=https://securelist.com/holy-water-ongoing-targeted-water-holing-attack-in-asia/96311/|access-date=2022-02-03|website=securelist.com|date=31 March 2020 }}</ref>

==See also==
* [[Malvertising]]

==References==
{{reflist}}

[[Category:Types of malware]]

{{Sourceattribution|Watering hole attack}}