Rigged industrial software site points to watering hole attack

 
By Lucian Constantin
IDG News Service | Sep 1, 2014 10:37 AM PT
 
http://images.techhive.com/images/article/2014/05/computer-hacker-aa006208-100266304-primary.idge.jpg
 
Attackers have rigged the website of an industrial software firm with a sophisticated reconnaissance tool, possibly in preparation for attacks against companies from several industries.
The incident was detected last week by researchers from security firm AlienVault who found rogue code injected into the website of a big industrial company that wasn't named. "The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing," said Jaime Blasco, director of the AlienVault Labs in a blog post.
Unlike most watering hole attacks where hackers inject malware-carrying exploits into websites visited by their intended targets, the purpose of this attack was only to gain detailed information about visiting computers.
The rogue code injected into the compromised site loaded a JavaScript file from a remote server that was actually a reconnaissance framework dubbed Scanbox, Blasco said. In addition to collecting basic information like the browser type, computer IP (Internet Protocol) address, operating system and language, this tool uses advanced techniques to detect which security programs are installed on the visitor's system, he said.
 
ComputerWorld/ full article here/ http://www.computerworld.com/article/2600767/security/rigged-industrial-software-site-points-to-watering-hole-attack.html