What is a watering hole attack?
Definition
A watering hole attack is when an attacker infects a website that a specific group of people visit often, so that the computers of people in that group get infected when they visit it.
- Category
- Attacks
- Also called
- watering hole attacks, waterhole attack
- Last updated
The name comes from predators waiting at a watering hole instead of chasing prey. NIST's glossary describes it as a security exploit where the attacker infects websites that are frequently visited by members of the group being targeted, with the goal of infecting a computer used by one of them when they visit the infected website.
The attacker never has to contact the target. Instead they pick a site the group already trusts, such as an industry news site, a professional forum, a supplier's portal or a local community page, and plant malicious code on it. Visitors load the page as usual. If their browser or software has a flaw the code can use, their device gets infected without them clicking anything unusual.
A typical case: a group of engineers at one type of company all read the same trade forum. An attacker compromises the forum, and the engineers' work laptops start picking up malware from a page they visit every morning.
Why it works on careful people
Phishing relies on you being fooled by a message. A watering hole attack relies on you trusting a website you have good reasons to trust. Nothing looks wrong, so the usual advice about not clicking strange links does not help much. That is also why it is mostly aimed at specific groups (employees of a sector, members of a community) rather than the general public.
Watering hole vs. phishing
- Phishing goes to you: a message tries to trick you into clicking, signing in or paying.
- A watering hole attack waits for you: it sits on a site you already visit.
- A man-in-the-middle attack intercepts traffic between you and a site, rather than infecting the site itself.
For ordinary people the practical risk is that malware picked up this way can steal saved passwords, session logins and personal files, which then feed account takeover and identity theft.
How to protect yourself
- 1
Install updates quickly
These attacks usually depend on a known flaw in your browser, plugins or operating system. Turn on automatic updates for all three so the flaw is closed before the attacker's code reaches you.
- 2
Use a current browser and remove plugins you don't need
Fewer plugins and extensions means fewer flaws to exploit. Remove the ones you no longer use.
- 3
Keep security software on and up to date
Anti-malware tools can block known malicious code even when it comes from a site you normally trust.
- 4
Use unique passwords and a second step
If malware does take saved passwords, unique passwords plus two-factor authentication limit the damage to one account instead of all of them.
- 5
Tell your IT team if a trusted site behaves oddly
If a site you use at work suddenly asks you to install something or download an update, stop and report it instead of continuing.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Who do watering hole attacks target?
Usually a specific group that shares a habit, such as employees in one industry or members of one community. The attacker picks a website that group visits and compromises it.
Can I get infected just by visiting a site?
Yes, if the site was compromised and your browser or software has a flaw the code can use. Keeping everything updated is the main defence.
Is a watering hole attack the same as phishing?
No. Phishing tricks you with a message. A watering hole attack infects a website you already visit, so there is no message to spot.
Sources
Something wrong or out of date? Tell us and we'll re-check it.