Reconnaissance code on industrial software site points to watering hole attack

Attackers are using a sophisticated Web-based tool to gather information on potential targets, researchers from AlienVault said

Attackers have rigged the website of an industrial software firm with a sophisticated reconnaissance tool, possibly in preparation for attacks against companies from several industries.

The incident was detected last week by researchers from security firm AlienVault who found rogue code injected into the website of a big industrial company that wasn't named. "The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing," said Jaime Blasco, director of the AlienVault Labs in a blog post.

Unlike most watering hole attacks where hackers inject malware-carrying exploits into websites visited by their intended targets, the purpose of this attack was only to gain detailed information about visiting computers.

The rogue code injected into the compromised site loaded a JavaScript file from a remote server that was actually a reconnaissance framework dubbed Scanbox, Blasco said. In addition to collecting basic information like the browser type, computer IP (Internet Protocol) address, operating system and language, this tool uses advanced techniques to detect which security programs are installed on the visitor's system, he said.

According to the AlienVault analysis, Scanbox also tests if the computer uses Microsoft's Enhanced Mitigation Experience Toolkit (EMET) anti-exploitation tool and enumerates the locally installed versions of Adobe Flash, Microsoft Office, Acrobat Reader and Java -- programs that are frequently targeted with Web-based exploits to install malware.

Some of the techniques used by Scanbox have been observed by the AlienVault researchers in other watering hole campaigns this year.

In this recent attack, the framework also deployed a JavaScript-based keylogger on the compromised site that recorded all keystrokes typed visitors, including passwords and other sensitive data entered into Web forms, Blasco said. "This is a very powerful framework that gives attackers a lot of insight into the potential targets that will help them launching future attacks against them."

Attacks might already be happening, as the AlienVault researchers found evidence that the server hosting the Scanbox framework was also used to serve Java exploits. Their blog post contains domain names and IP addresses that companies should search for in their traffic logs to determine if they've been targeted.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags AlienVaultsecurityDesktop securityspywaremalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?