Watering-Hole Attack Targeting Water Utilities Discovered
The Florida Water Plant Compromise Happened Hours After an Employee Accessed A Malicious Website.
Last updated on May 24, 2021
Back in February, a hacker gained access to the water system of Oldsmar, Florida and tried to pump in a dangerous amount of a sodium hydroxide (lye). Luckily, a worker spotted it and reversed the action.
Recently, researchers from security firm Dragos found that the WordPress website of a water infrastructure construction company in Florida was “hosting malicious code” in the footer file. This was a way to lure in operators at water utilities in Florida and elsewhere. Over 1,000 end-user computers visited the site during the 58-day window that it was infected.
According to the report, on February 5 at 9:49 am ET, an employee for the city of Oldsmar visited the malicious website targeting water utilities. This was just hours before someone broke into the computer system for the city’s water treatment plant and tried to poison drinking water. Although the site likely played no role in the intrusion, the incident remains unsettling.
This is not a typical watering hole. We have medium confidence it did not directly compromise any organization. But it does represent an exposure risk to the water industry and highlights the importance of controlling access to untrusted websites, especially for Operational Technology (OT) and Industrial Control System (ICS) environments.
The threat actor spends time to gain strategic information about the target: observes which legitimate websites are more often visited by the members of the group. Then the attacker exploits a vulnerability and infects one of those trusted websites with malware, without the knowledge of the site’s owner. Eventually, someone from that organization will fall into the trap and get their computer infected. This way, the attacker gains access to the target’s entire network.
Just as predators lie in wait near watering holes frequented by their prey, hackers often compromise one or more websites used by the target group and plant malicious code tailored to those who visit them. These attacks work because of the constant vulnerabilities in website technologies, even with the most popular systems, such as WordPress, making it easier than ever to stealthily compromise websites. According to Dragos, the site appeared to target water utilities, especially those in Florida.
Over 100 pieces of visitors’ detailed information were gathered by the malicious code, including their OS and CPU type, browser and supported languages, geolocation services, time zone, video codecs, screen dimensions, browser plugins, touch points, input methods, and whether cameras, accelerometers, or microphones were present.
What’s more, visitors were redirected to two separate sites that collected cryptographic hashes that uniquely identified each connecting device and uploaded the fingerprints to a database hosted at bdatac.herokuapp[.]com.
Website compromised with a unique browser enumeration and fingerprinting script
Code from four different code projects was used by the fingerprinting script: core-js, UAParser, regeneratorRuntime, and a data-collection script observed on only two other websites, both of which are associated with domain registration, hosting, and web development company.
With the forensic information we collected so far, Dragos’s best assessment is that an actor deployed the watering hole on the water infrastructure construction company site to collect legitimate browser data for the purpose of improving the botnet malware’s ability to impersonate legitimate web browser activity. The botnet’s use of at least ten different cipher handshakes or JA3 hashes, some of which mimic legitimate browsers, compared to the widely published hash of a single handshake of a previous Tofsee bot iteration is evidence of botnet improvement.
Cezarina is the Head of Marketing Communications and PR within Heimdal® and a cybersecurity enthusiast who loves bringing her background in content marketing, UX, and data analysis together into one job. She has a fondness for all things SEO and is always open to receiving suggestions, comments, or questions.