Reconnaissance code on industrial software site points to watering hole attack

[InfoSec News <alerts () infosecnews org>]

http://news.techworld.com/security/3542635/reconnaissance-code-on-industrial-software-site-points-to-watering-hole-attack/

By Lucian Constantin
Techworld.com
01 September 2014

Attackers have rigged the website of an industrial software firm with a 
sophisticated reconnaissance tool, possibly in preparation for attacks 
against companies from several industries.

The incident was detected last week by researchers from security firm 
AlienVault who found rogue code injected into the website of a big 
industrial company that wasn't named. "The website is related to software 
used for simulation and system engineering in a wide range of industries, 
including automotive, aerospace, and manufacturing," said Jaime Blasco, 
director of the AlienVault Labs in a blog post.

Unlike most watering hole attacks where hackers inject malware-carrying 
exploits into websites visited by their intended targets, the purpose of 
this attack was only to gain detailed information about visiting 
computers.

The rogue code injected into the compromised site loaded a JavaScript file 
from a remote server that was actually a reconnaissance framework dubbed 
Scanbox, Blasco said. In addition to collecting basic information like the 
browser type, computer IP (Internet Protocol) address, operating system 
and language, this tool uses advanced techniques to detect which security 
programs are installed on the visitor's system, he said.

[...]



--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/