Spy code on industrial software site suggests watering hole attack
Attackers have rigged the web site of an industrial software firm with a sophisticated reconnaissance tool, possibly in preparation for attacks against companies from several industries.
The incident was detected last week by researchers from security firm AlienVault who found rogue code injected into the web site of a big industrial company that was not named. “The web site is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing,” said Jaime Blasco, director of the AlienVault Labs in a blog post.
Unlike most watering hole attacks where hackers inject malware-carrying exploits into web sites visited by their intended targets, the purpose of this attack was only to gain detailed information about visiting computers.
According to the AlienVault analysis, Scanbox also tests if the computer uses Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) anti-exploitation tool and enumerates the locally installed versions of Adobe Flash, Microsoft Office, Acrobat Reader and Java — programs that are frequently targeted with web-based exploits to install malware.
Some of the techniques used by Scanbox have been observed by the AlienVault researchers in other watering hole campaigns this year.
Attacks might already be happening, as the AlienVault researchers found evidence that the server hosting the Scanbox framework was also used to serve Java exploits. Their blog post contains domain names and IP addresses that companies should search for in their traffic logs to determine if they’ve been targeted.
Lucian Constantin, IDG News Service