Watering hole attacks refer to a strategy where hackers infect websites frequently used by a particular target group. The targets usually include large organizations.
Hackers infect websites with some kind of malicious code or virus. Once the virus is downloaded onto the target device, the hacker can access the personal and sensitive information of the targets and even the organization. They can also spread fast and are difficult to detect. Hence, organizations must know how watering hole attacks can be prevented.
Here are some useful tips:
- Set up advanced threat detection tools that monitor possible breaches of organization websites.
- Create a secure web gateway architecture to prevent malicious files from entering the organization network via email and messages.
- Constant updating and testing of security architecture are vital to preventing watering hole attacks.
- Invest in employee training as they form security endpoints of an organization’s architecture.
Individual users will benefit from regular, pre-emptive antivirus scans to ensure their devices are malware-free. Our top recommendation is Norton 360, which consistently outperforms the dozen other antivirus programs we’ve tested.
Want to know more about how watering hole attacks work and how they can be detected? Give the rest of the article a read.
A water holing attack involves a strategic attack on places or sites frequented by a target group. Therefore, watering hole attacks are typically used to attack sites, organizations, groups, and enterprises.
Watering hole attacks are not frequent but are still dangerous because they are hard to detect and can quickly infect large organizations. Read on for a better understanding of watering hole attacks, how they work, and how they can be prevented.
What is a Watering Hole Attack?
The term watering hole attack is drawn from nature. The term “watering hole” refers to places, often bodies of water, where animals tend to congregate. Predators camp out near such watering holes to make their hunt easier.
In the digital world, cybercriminals identify websites or services frequently used by their targets. They then infect the website and lure their target users toward the compromised website. For example, in 2013, developers across leading technology companies like Apple and Facebook were targeted using a fake Apple development website.
A watering hole attack aims to infect the target’s system and gain access to personal information, trade secrets, and intellectual property. As a result, the websites of large organizations or high-profile groups are the most frequent targets of watering hole attacks. In some cases, hackers target individual devices to build their botnets.
Watering hole attacks are particularly dangerous as they target weak links in a system’s security chain. Employees who do not adhere to security guidelines are often easy targets of such attacks and can compromise the entire security chain. Hence, organizations and individuals must understand how watering hole attacks work and how they can be prevented.
How Does a Watering Hole Attack Work?
A watering hole attack is not a kind of exploit or malware. Instead, it refers to the hacker’s strategy to infect the target user’s devices. The steps involved in the strategy are listed below:
1. Research and identification
The first step in opportunistic watering hole attacks is identifying the website or service most frequently used by the intended victim. The hacker uses search trends, social media, and similar data to identify such websites. The security of the target website is another important factor in identifying the watering hole.
2. Analysis and implementation
Once the attacker has identified the target website, they will analyze it to identify weak spots. Usually, attackers inject malicious code, usually a remote access trojan (RAT), into the website’s script. They usually exploit plug-ins, such as JavaScript and ActiveX, to compromise the website. In some cases, watering hole attackers may also exploit zero-day vulnerabilities in the website to insert malware.
Now, the trap is set, and the hacker will wait for users to land on the site and activate the malicious code.
3. Luring
Not all watering hole attacks involve this step. Luring refers to emails or messages that the hacker sends to intended victims to lure them to the fake or compromised websites. As discussed above, the website is one that a group of users frequent. Hence, hackers send them context-specific and relatable emails to lure them to the website.
4. Execution
Water holing occurs when the victim visits the site and downloads the malicious payload onto their device. The download can be triggered automatically, without the victim knowing, in what is known as a “drive-by download.” In other cases, the victim is presented with a pop-up or advertisement redirecting them to a malicious website or program.
Once the malicious payload is downloaded, the watering hole attacker can achieve a variety of objectives. They can gain access to the victim’s information, infiltrate other devices on the network or include the victim’s device in their botnet.
Famous Examples of Watering Hole Attacks
Water holing has been used to breach the cyber defenses of some of the world’s largest companies. Here are a few watering hole attacks that received significant public attention.
Microsoft, Apple, and Facebook (2013)
Developers are often the targets of watering hole attacks as they have access to a company’s internal networks. This 2013 water hole attack targeted Microsoft, Apple, and Facebook developers by using a fake iPhone SDK development website. Users who visited the site were infected with a trojan virus.
While the attack primarily focused on developers in these companies, it spread to other firms across industries, including auto manufacturers and U.S. government agencies.
CCleaner (2017)
CCleaner is a widely used utility tool that cleans up your device’s memory. One of its distributions was infected with a trojan that the site unwittingly spread to 2.27 million users. The attack targeted telecom equipment companies in the United States, Japan, South Korea, and Taiwan.
Once the infected CCleaner was downloaded onto a user’s device, it sent back information about who the device belonged to. If it belonged to an employee in a telecom company, another malware was downloaded that allowed hackers to take over the computer.
While the vulnerability spread to several devices, only a few were affected. As per Avast, which owns CCleaner, only about 23 total devices were infected by the exploit.
Vietnam (2018)
OceanLotus is a well-known cyber-espionage group that has been active since 2012. In 2018, it carried out a large-scale watering hole attack aimed primarily at the Vietnam government. Nearly 21 sites associated with the Vietnamese government were infected by the attack.
The attack involved a complex multi-stage process. The first stage checked the user’s IP to determine if they were from Cambodia or Vietnam. The second stage was triggered if the IP was traced to either of these countries. In this stage, the hacker triggered the download of malware that allowed them to control the infected device.
Hong Kong (2021)
Pro-democracy protestors in Hong Kong were targeted by an unknown group using a watering hole attack. The attack was spread using the website of a popular radio station, as well as other fake websites.
It exploited a zero-day vulnerability to install a backdoor, known as DazzleSpy, in iOS and macOS devices. Once the backdoor was installed, hackers could successfully execute various functions, including searching for files, executing programs, renaming and deleting files, and even starting or ending remote sessions.
Signs That You’ve Been the Target of a Watering Hole Attack
Now that we know what water holing is, let’s understand how you can tell when you’ve been the victim of one. As we mentioned earlier, the attack can be hard to detect until it spreads to a few devices. However, there are a couple of telltale signs you and your organization should look out for:
- Increase in frequency of emails directing users to a specific website. If individuals in your organization start receiving suspicious messages directing them to a particular site, it’s possible that a watering hole attack is being implemented.
- Reduced computer performance. A significant slowdown in your device’s performance could be a signal that it’s being used as part of a botnet through water holing. However, it’s also possible that your device is slowing down because of a full memory. Learn how to differentiate these scenarios in our article on monitoring software.
- Constant pop-ups. A sudden uptick in pop-ups prompting you to download files or displaying annoying ads is a clear signal that a virus has infected your device.
- Changes to security settings in your browser. Another way to tell if a watering hole attack has targeted you is to check if security settings on your browser or device have been changed to allow for installation from unknown sources. Such settings are often changed to allow for malicious payloads to be installed.
Suppose you’re experiencing some of the above signs. In that case, you must run an antivirus scan at the earliest to ascertain whether you’ve fallen prey to a watering hole attack or another exploit.
How to Deal with Water Holing
Let’s say a watering hole attack has hit you or someone in your organization. What are the steps you should take for remediation?
Here’s what we recommend:
- Locate and remove the malware from your device. This can be done using an antivirus scanner, such as BitDefender.
- Disconnect the infected device from the larger network to prevent further spread. This is particularly important in larger organizations where several devices are usually on the same network.
- Issue urgent communication to all network participants to refrain from visiting the infected website or clicking on links/attachments received via mail.
- If you’re a large organization and the scale of the attack is large, you may want to inform your local cyber security cell or response team.
The above steps should help limit the damage a watering hole attack can cause. However, it’s always better to take preventive steps that avoid such an attack in the first place. Some effective preventive measures are outlined in the next section.
Preventing a Watering Hole Attack
The best way to deal with water holing is by preventing one from happening in the first place. While it may not be possible to avoid watering hole attacks entirely, the following steps should decrease their likelihood significantly.
Please do note that most of the steps listed below cater to organizations, as they are the primary victims of watering hole attacks.
- Establish a robust threat detection mechanism. It’s important to have oversight of potential threats to your network and system devices. For organizations, this should include advanced threat analysis tools that constantly scan frequently visited sites for bugs and vulnerabilities. Users should have a firewall and threat shield installed to detect malicious elements.
- Set up a comprehensive secure web gateway. Once you’ve detected and identified potentially malicious sites and applications, you must establish gateway policies that block such content and prevent users from accessing them. A secure web gateway will enforce these policies across the organization, ensuring users don’t accidentally visit malicious sites or download malware via links and attachments.
- Keep your security solutions updated. Individuals and organizations should ensure they’re running the latest version of their security solutions, as these contain important patches and new libraries.
- Regularly test your security systems. Organizations should work with white hat hackers to constantly test their security architecture. Bug country programs also help identify vulnerabilities before they are exploited.
- Invest in training for employees. Employees are the security endpoints for any organization. If their security practices are lacking, the organization remains vulnerable no matter the solutions or software used. Hence, it is important to invest in cybersecurity-related training and skilling.
For individual users, water holing can be prevented, to a large extent, by having a robust antivirus scanner and firewall in place. We would recommend Norton 360, our highest-rated antivirus scanner, as its suite of features includes virus scanning, advanced threat protection, and protection against identity theft. Read our review of Norton 360 to learn more, or visit its website through the button below.
Is Water Holing Social Engineering?
Yes, many water hole attacks are a form of social engineering. Social engineering occurs when cybercriminals manipulate their target into divulging information. These targeted attacks rely on identifying behavior trends across the target group and then exploiting them to achieve their purpose. Using prompts and emails to lure the target to the infected website also adds an additional element of social engineering.
In fact, aside from water holing, several exploits rely on social engineering to achieve their purposes. Some of these are:
- Supply chain attack: Supply chain attacks target the weakest link in an organization’s supply chain. Usually, these attacks are targeted at an organization’s suppliers or vendors, who may not have the best security practices. For example, in 2022, Toyota halted production of cars after Kojima Industries Corp, a parts supplier, was hit by a cyberattack.
- Man-in-the-middle (MitM) attack: Hackers intercept communication between two parties to obtain sensitive information, such as bank details. MitM attacks often involve people joining free Wi-Fi networks that are monitored and intercepted by the cyber criminals. In 2019, communications between a Chinese venture capital firm and an Israeli start-up they were funding were intercepted to steal close to $1 million.
- Spear phishing attack: An increasingly common occurrence, spear phishing involves sending employees fraudulent emails from their seniors that direct them toward malicious software. Unlike watering hole attacks, spear phishing usually targets specific individuals within an organization instead of the organization itself. For instance, in 2019, several users reported receiving emails impersonating UK’s telecom operator EE. The emails asked recipients to provide their credit card details to resolve billing-related issues.
- Honeypot: A honeypot is a technique used by security agencies to lure cyber criminals. They use intentionally compromised systems that hackers infect with malware. Honeypots help security officials understand how cybercriminals work. Cybersecurity and antivirus companies are some of the most common users of honeypots.
Protect Yourself Against Water Holing Today
A watering hole attack can be pretty devastating for organizations (and individuals), leading to compromised devices and leaked information. The tips we’ve highlighted above should help you detect, remove, and protect against potential watering hole attacks.
Of course, the most important takeaway from the article is that you should be vigilant and careful about your online actions. Given the sheer number of threats online today, it’s advisable to adopt a cautious approach — especially regarding suspicious emails, messages, and pop-ups. Additionally, keep an antivirus scanner, such as Norton 360, installed and updated on your devices at all times.
Learn more about some major threats on the internet in the following articles:
- How to Recognize and Prevent CEO Fraud
- What is a DDoS Attack and How Do DDoS Attacks Work?
- What is Identity Theft and How Did It Become Such a Big Problem?
Have any questions about watering hole attacks that remain unanswered? Check out the section below where we’ve answered some of the most common questions about watering hole attacks.
In a watering hole attack, the hacker targets a site or application frequently used by members of the target group. The website is infiltrated with a malicious script that either redirects users toward malware or triggers its automatic download on the user’s device.
The objective is to infiltrate the device and obtain sensitive and personal information, such as intellectual property and trade secrets. Learn more about watering hole attacks in this article.
A watering hole attack broadly involves the following steps:
- Identification of the target website or application
- Analysis of the website or applications vulnerabilities
- Infection of the website/application with a malicious payload
- Luring of the targets to infected website/application using fake but realistic emails
- Downloading and installation of the payload on the user’s device
Get a detailed explanation of how watering hole attacks work here.
Social engineering refers to manipulating targets to obtain sensitive and personal information. In water hole attacks, users are manipulated into believing they are using a safe website or carrying out instructions from a superior. Hence, watering hole attacks are a part of social engineering.
Watering hole attacks can be difficult to identify until they’ve infected a solid number of targets. However, some early signals users and organizations can watch out for are:
- Increase in frequency of emails directing users to a particular website/applications
- Numerous and frequent pop-ups on the infected device
- Reduced computer performance
- Unauthorized changes to security settings on your browser or device
Learn more in our written guide about identifying water holing.
