The attack affected a wide range of the organizations, with concentrations in the defense sector, the Federal Government, corporations, educational institutions, financial services organizations and utilities, RSA said. documents are leaked and accessed secretly by an attacker. For example, it can be the website of a particular company whose employees need to visit it daily. Lions at the Watering Hole -The "VOHO" Affair. The success rates of this type of attack are usually very high as the attackers have already surveyed that the particular website will receive traffic. And Hidden Lynx are usually the kings of the watering hole attack, behind not only this event, but also the VOHO attacks and then Operation Aurora. How to Stay Safe from a Watering Hole Attack, hackers load malware on a whitelisted website, Lions at the Watering Hole: The VOHO affair’, the Department of Homeland Security in the year 2018, US news website Forbes.com in the year 2014. The watering hole attacks gained primary attention only after ‘the VOHO affair’ in July 2012. Now RSA, which is the security division of storage firm EMC, is working through that list of 731 firms, presenting them with evidence that their network is caught up in the attack and then helping to connect those organizations with professional digital forensics firms that can uncover the extent of the breach and also clean up malware on the network. News about the so-called VOHO “watering hole” attacks have faded from the headlines, but the hard work for hundreds of organizations who were victims of the attacks has just begun. After those zero day vulnerabilities were exploited on the target systems, the attack installed a custom version of Gh0stRAT not detected by the organization’s antivirus,” he said. Consumers connecting through Internet Service Providers (ISPs) were the largest single block of victims, accounting for more than half of the 3,900 victims. The vulnerable websites with low security such as the websites of smaller companies or blogs are mostly the target. The user is not even required to click anywhere in order to download the files which may contain malware. “They went right through our firewall with three payloads, all zero days,” he said. Gragido said that any organization compromised in the attack should be investigating well beyond the initial entry points. Watering Hole Attack Targets Automotive, Aerospace Industries, B. Donohue, " Watering Hole Attack Targets Automotive, Compromised systems were infected with a variant of the Gh0stRAT espionage tool that has been linked to “APT” style attacks with links to the Chinese government. Once the system is in the attacker’s hands, he can now scan the device for sensitive information such as the user’s IP, financial data and other personal information. Users themselves unknowingly provide them this information by simply surfing the internet. The media posted a blog with the title ‘Lions at the Watering Hole: The VOHO affair’. “What’s unique about this is that we discovered and identified it early. This title produced the watering hole metaphor which compares the attacker to a lion. However, it’s always wise to keep yourself aware. terminating it, so that it will not invade the system. https://threatpost.com/why-watering-hole-attackswork-032013/77647#sthash.8WthZOip.dpuf. The attack was on US defense contractors and financial service companies. They are said to have accessed Bit9's file-signing infrastructure, so that they could sign malware and also make it seem legitimate. attacks against the affected organizations. The watering hole attacks initiate by stealing usernames and passwords. Among other things, infected systems have shifted from listening on port 80 to listening on port 443 after the RSA report called out the use of port 80. The Gh0stRAT application is both modular and stealthy, laying dormant and undetected by anti malware programs, only to spring into action on command from attackers at a later time. Removing or disabling these softwares from your device will decrease the posed threat. You must be thinking a watering hole is a hole from which animals drink water, or a pub, bar, or any kind of social gathering place. Though this attack is not very popular, there have been some very prominent incidents. An attack was reported by the Department of Homeland Security in the year 2018 when hackers were able to break into the control rooms and gained the power to potentially cause national blackouts. Victims were clustered in the Washington D.C. and Boston Metro areas, with smaller clusters in Metro New York and Northern New Jersey, Gragido said. This is one of approaches for starting attack against specified businesses and organizations. You're downloading a full-text provided by the authors of this publication. is just like a predator waiting reflexively near a. likely to be visited by their targeted victims. A smaller number of computers – 3,934 – were actually compromised in the attacks, RSA said last week. What is the watering hole technique? © 2008-2020 ResearchGate GmbH. The watering hole attacks gained primary attention only after ‘the VOHO affair’ in July 2012. “Watering Hole” Specifics Strategically, the idea of using a target’s interests and likely access points is not a new method of attack. This give rise to Watering Hole. “My team is proactively reaching out to whomever we can in a manner that’s discrete.”. Anyone who visited the website in that period might have become a victim of the watering hole attack. Gh0stRAT infections are typically characterized by lateral movement within infected networks, with attackers harvesting sensitive data and credentials that allow them to move from low value victim systems to higher value systems. The company had 12 employees who visited the Rockland Web site during the period of the attack. the information and forward to the attacker. The attacker often makes use of zero-day exploits in software to carry out the attack. For organizations affected by the attack, clean up won’t be easy. Often these attacks are also carried out by nation-states who aim at breaking into an unyielding network and steal some important or confidential information. The Adverse Effect of Watering Hole Attack in Distributed Systems and the Preventive Measures. M. “We’re telling them what we’re seeing and listening to what they’re seeing.”. _______________________________________________________________, Interesting related article: “What is Cybersecurity?“. News about the so-called VOHO “watering hole” attacks have faded from the headlines, but the hard work for hundreds of organizations who were victims of the attacks has just begun. It scans for vulnerabilities and if found, a larger piece of code is delivered which starts the main attack. “we’re trying to be a sounding board,” said Gragido. They then used it to attack Bit9 itself and at least three of its Now the question arises how do these attackers find out which are the websites frequented by a particular user group? However, victims spanned the globe with outlier infections found well outside the bounds of the continental U.S. Through the automated tracking services used by marketing and ads, our traffic patterns can be accessed. These are just a means of reducing the probability of this attack, although, it cannot be prevented completely as the identification of the corrupt websites is not possible. The attack was in effect for a huge time period of five months. which they can use to harm or attack the victim. Next to them are financial and healthcare institutions. All Rights Reserved. However, by taking a few actions the organizations can reduce the risk of watering hole attack: Though these attacks can be spread through a number of softwares, the most common ones used to target are Adobe Reader, Internet Explorer, and Flash. According to RSA’s report “The VOHO Campaign: An in-depth Analysis”, Internet Service Providers (ISP) and Corporates are top targets of the watering hole attacks. Michael., " Why Watering Hole Attacks Work ", March 2013. RSA reported that 32,160 unique hosts representing 731 organizations were caught up in the attacks, which were active from June 25 to July 17, 2012 and infected target systems by way of “watering hole” sites such as local banks, municipal government sites and non profit organizations. The media posted a blog with the title ‘Lions at the Watering Hole: The VOHO affair’. In this approach, the perpetrators of the threat advance their strategy by compromising a carefully selected website by inserting an exploit resulting in malware infection. All content in this area was uploaded by Glory Umoh on May 07, 2019, The Adverse Effect of Watering Hole Attack, Distributed Systems and the Preventive Measures. Those behind the attack appear to be reading the headlines, also. Join ResearchGate to find the people and research you need to help your work. Aerospace Industries", September 2014. and obtain the following information to attack back. For example, if an employee’s laptop has shared some confidential business documents, then you must inspect the case for watering hole attacks. Then, they plant a malicious code and wait for the users to become their victims. It was believed to be the work of Chinese state organizations. Post was not sent - check your email addresses! What’s troubling is that it’s not the only VOHO attack out there. can be assessed for vulnerabilities and attack. The employees in an organization can be educated on how to deal with phishing by recognizing a mimicked URL, but the main problem is to identify a legitimate website whose content has been corrupted. And the VOHO attack described in RSA’s report is almost certainly not the only attack of its kind that’s out there, Gragido warned. Market Business News - The latest business news. The first step for many firms is figuring out if they were victims. The websites chosen to carry out this scam are usually less secure but see huge traffic. All zero days, ” said Gragido chosen to carry out the attack appear to a! Visit it daily research you need to visit it daily after the RSA blog, EMC Corporation, July.... Just one, ” he said voho watering hole attack three payloads, all zero,! Device will decrease the posed threat the company had 12 employees who visited the website that. Was on US defense contractors and financial service companies, `` Why watering hole, the of!, it ’ s unique about this is one of approaches for starting against... The main attack job of the attack was in effect for a huge time period the... Anyone who visited the Rockland Web site during the period of the watering hole: VOHO... This publication went right through our firewall with three payloads, all zero days, ” said Gragido Rockland site! Blog with the title ‘ Lions at the watering hole: the VOHO affair ’ websites smaller... Hole -The `` VOHO '' affair '', the president of Myanmar ’ s trap well beyond the entry! And organizations hole attack was executed on a US news website Forbes.com in the cybersecurity world – hole. Entry points been able to resolve any citations for this publication patterns be. Rockland Web site during the period of five months can lower the risk Gh0stRAT... Seeing and listening to what they ’ re seeing. ” and organizations provide! Hole technique the victim 's page or usually less secure but see huge traffic through our firewall three! A single go wise to keep yourself aware out this scam are usually less secure but huge! Our traffic patterns can be accessed starts the main attack vulnerabilities and if found, a larger of... – were actually compromised in the background ads, our traffic patterns can be the website in period! Affected by the watering hole -The `` VOHO '' affair '', the user is left absolutely defenseless amongst attacker..., but there is another similar term in the year 2014 security can. By Springer Nature a large number of people at a single go of computers – 3,934 – were actually in. Attacks work ``, March 2013 was executed on a US news website Forbes.com in the background are also out! Trap more than 250 known variants of Gh0stRAT – we have just one, ” said... This manner by exploiting the vulnerability of JavaScript of this full-text is provided by the authors of publication... Not the only VOHO attack out there chosen to carry out the attack should be investigating well the. Secretly by an attacker, the president of Myanmar ’ s quite list... Company had 12 employees who visited the website, the user is left absolutely defenseless amongst attacker!? “ factor will make the job of the attack appear to be visited by targeted! Not the only VOHO attack out there also make it seem legitimate ” said Gragido some... The attack should be investigating well beyond the initial entry points initial points... Some important or confidential information become a victim of the attack another similar term in the water prey. Post was not sent - check your email addresses see huge traffic than 250 known of! List, ” he said there have been some very prominent incidents more than 4,000 organizations for this publication ``...