Paper Info
Title
Catching predators at watering holes: finding and understanding strategically compromised websites.
Abstract
Unlike a random, run-of-the-mill website infection, in a strategic web attack, the adversary carefully chooses the target frequently visited by an organization or a group of individuals to compromise, for the purpose of gaining a step closer to the organization or collecting information from the group. This type of attacks, called \"watering hole\", have been increasingly utilized by APT actors to get into the internal networks of big companies and government agencies or monitor politically oriented groups. With its importance, little has been done so far to understand how the attack works, not to mention any concrete step to counter this threat. In this paper, we report our first step toward better understanding this emerging threat, through systematically discovering and analyzing new watering hole instances and attack campaigns. This was made possible by a carefully designed methodology, which repeatedly monitors a large number potential watering hole targets to detect unusual changes that could be indicative of strategic compromises. Running this system on the HTTP traffic generated from visits to 61K websites for over 5 years, we are able to discover and confirm 17 watering holes and 6 campaigns never reported before. Given so far there are merely 29 watering holes reported by blogs and technical reports, the findings we made contribute to the research on this attack vector, by adding 59% more attack instances and information about how they work to the public knowledge. Analyzing the new watering holes allows us to gain deeper understanding of these attacks, such as repeated compromises of political websites, their long lifetimes, unique evasion strategy (leveraging other compromised sites to serve attack payloads) and new exploit techniques (no malware delivery, web only information gathering). Also, our study brings to light interesting new observations, including the discovery of a recent JSONP attack on an NGO website that has been widely reported and apparently forced the attack to stop.
Year
DOI
Venue
2016
10.1145/2991079.2991112
Annual Computer Security Applications Conference
Field
DocType
ISSN
Internet privacy,Authentication,Computer security,Computer science,JSONP,Exploit,Pre-play attack,Adversary,Compromise,Malware,Government
Conference
1063-9527
Citations 
PageRank 
References 
2
0.45
16
Authors
7
Name
Order
Citations
PageRank
Sumayah A. Alrwais11267.44
Kan Yuan21377.79
Eihal Alowaisheq3463.39
Xiaojing Liao49613.66
Alina Oprea5106756.47
Xiaofeng Wang62543161.68
Zhou Li744130.45