Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring an Application Access Token.
Multiple ways of delivering exploit code to a browser exist, including:
Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.[1]
Typical drive-by compromise process:
ID | Name | Description |
---|---|---|
C0033 | C0033 |
During C0033, PROMETHIUM distributed StrongPity through the compromised official Syrian E-Gov website.[2] |
S0463 | INSOMNIA |
INSOMNIA has utilized malicious JavaScript and iframes to exploit WebKit running on vulnerable iOS 12 devices.[3] |
S0289 | Pegasus for iOS |
Pegasus for iOS was distributed through a web site by exploiting vulnerabilities in the Safari web browser on iOS devices.[4] |
S0328 | Stealth Mango |
Stealth Mango is delivered via a a watering hole website that mimics the third-party Android app store APKMonk. In at least one case, the watering hole URL was distributed through Facebook Messenger.[1] |
S0311 | YiSpecter |
YiSpecter is believed to have initially infected devices using internet traffic hijacking to generate abnormal popups.[5] |
ID | Mitigation | Description |
---|---|---|
M1001 | Security Updates |
Security updates frequently contain patches for known exploits. |
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0013 | Sensor Health | Host Status |
Mobile security products can often alert the user if their device is vulnerable to known exploits. |