Watering Hole and Typosquatting Attacks
Cybersecurity Forensics Lesson 2.2.5
Watering Hole Attacks
- Taken from the same behavior observed from animals in the wild do when they return to the same areas for water and nutrition every time
- A watering hole is a metaphor for a place that users go to seeking information or resources online.
- This is typically paired with a popular site that has been compromised or a fake site setup to mimic a legit site.
- In either case the site serving as the watering hole usually contains malware and is activated from a user visiting the page.
- The frequency of visits to the page allows little effort on the part of the malicious user but has potential for a high reward
Defending Against Watering Hole Attacks
- Many times, little to nothing can be done about the watering hold itself; however, being proactive in your defenses is key to protecting yourself.
- Keeping anti-malware/ anti-virus software updated
- Being attentive to what is downloaded, noticing things like downloads occurring without any input from the end-user
- Take note of changes in your devices and how well it functions as less optimal performance might be a sign of something malicious
Typosquatting
- Involves slightly changing the URL, such as seen in day-to-day typos, to resemble a well-known website.
- There are signs to look for such as:
- Spelling
- Domain listed such as .com vs .net
- Security checks such as http vs. https
- Google owns a few domains that are common typos for Google as shown in the table to prevent things such as typosquatting
| Google owned domains with common typos |
|---|
| Gooogle.com |
| Gogle.com |
| Gogole.com |
| Googl.com |
Hijacking Hijinks
- Client hijacking involves concealing malicious links to malware and sites, so they appear to be legitimate to the casual user.
- Clickjacking involves hiding a link or object containing a link above the object the user would normally click on, such as an image.
- URL hijacking involves slight changes to URLs to mimic the original, such as typos, which is where the term typosquatting comes from.
Session Hijacking
- Cookies are small bits of information that save authentication data and other website preferences.
- Session hijacking occurs when an attacker steals the cookie used to authenticate a user on a website.
- Once stolen, the unauthorized user can login to sites with the victim’s cookie