In the last two days, after the BBC website reported news about a waterholing attack against the Central Tibetan Administration website, Websense Security Labs ThreatSeeker Intelligence Cloud has detected that the website has, indeed, been compromised to serve malicious code.
Over the last two years, attacks like these have targeted pro-Tibet websites and other human rights organizations around the world. A waterholing attack is one that targets users of specific websites with the aim to install malware on their systems (usually using a backdoor approach) to collect documents, email contacts, social contacts, and passwords. The frequency of these attacks prompted Websense Security Labs to check our collective threat intelligence for any other websites that are considered pro-Tibet to see if they are affected by this kind of attack.
One of the trends with targeted attacks in the last few years is that any installed malware binaries connect to dynamic DNS websites. One of the most interesting aspects of this specific attack is that a successful exploit downloads a binary that connects to a small Dynamic DNS service offered by none other than a Germany-based security appliances and services company, which reaffirms the notion that perpetrators pick and choose the parts of their attack infrastructure.
Although the website does not have a high Alexa rank, the analysis concluded that it wasn't a scattered attack, but a targeted injection to infect the users of that website.
Image Gallery
