text: Step of Attack Workflow

text: Width of Purpose

text: The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker.

text: MORE INFORMATION

text: Figure 1: Reduction on the number of files cleaned per compromised site. Source: Sucuri

text: al ic ert V

text: Attack Vector SQLi LFI XSS PHPi RFI CMDi Other

text: Figure2: Source: Akamai

text: n io ill

text: n (i

text: Source: Sonicwall

text: Source: Positive Technologies

text: “The Future Is the Web! How to Keep It Secure? ” October 2019. Acunetix.

text: 2..“What Is a Web Application Attack and how to Defend Against It”. 2019. Acunetix..

text: https://www.acunetix.com/websitesecurity/web-application-attack/ 3. “2020 State of Application Services Report” F5 Networks, 2020.. https://www.f5.com/state-ofapplication-services-report 4. “Sonicwall Cyber Threat Report”. 2020. Sonicwall. https://www.sonicwall.com/resources/2020cyber-threat-report-pdf/

text: “The State of Web Application Security, Protecting Application in the Microservice Era.” 2019.

text: Radware. https://www.radware.com/resources/was-report-2019/ 6. “API Security Top 10 2019.” OWASP. https://owasp.org/www-project-api-security/

text: Raymond Pompon, Sander Vinberg. “Application Protection Report 2019, Episode 5: API

text: Breaches and the Visibility Problem.” August 13, 2019. F5 Labs https://www.f5.com/labs/articles/threat-intelligence/application-protection-report-2019-episode- 5-api-breaches-and-the-visibility-problem

text: “Unauthorized Logins on Fast Retailing Online Store Websites due to List Type Account Hacking

text: and Request to Change Password.” May 13, 2019. Fast Retailing. https://www.fastretailing.com/eng/group/news/1905132000.html

text: “Web Applications vulnerabilities and threats: statistics for 2019.” February 13, 2020. Positive

text: Technologies. https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/#id9 10. Esrtevao Avillez. “2019 Website Threat Research Report.” 2019. Sucuri. https://sucuri.net/wpcontent/uploads/2020/01/20-sucuri-2019-hacked-report-1.pdf

text: “State of the Internet / Security | Web Attacks and Gaming Abuse (Volume 5, Issue 3).” 2017-

text: 2019. Akamai. https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/sotisecurity-web-attacks-and-gaming-abuse-executive-summary-2019.pdf

text: “State of the Internet Security | Financial Services – Hostile Takeover Attempts (Volume 6,

text: Issue 1).” 2020. Akamai. https://www.akamai.com/us/en/multimedia/documents/state-of-theinternet/soti-security-financial-services-hostile-takeover-attempts-report-2020.pdf

text: “Q4 2016 State of The Internet Security Report” 2016.Akamai.

text: “Q4 2017 State of the Internet Security Report” 2017. Akamai.

text: https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/q4-2017-state-ofthe-internet-security-report.pdf 15. “2019 Cyberthreat Defense Report.” 2019. CyberEdge Group. https://cyber-edge.com/wpcontent/uploads/2019/03/CyberEdge-2019-CDR-Report.pdf

text: “AppSec Advisor: Injection Attacks.” October 2019. CIS Center for Internet Security.

text: “Cybersecurity threatscape: Q3 2019. ” December 2, 2019. Positive Technologies.

text: “Virtual Patching Best Practices.” OWASP. https://owasp.org/www-

text: Breaches and the Visibility Problem.” August 13, 2019. F5 Labs. https://www.f5.com/labs/articles/threat-intelligence/application-protection-report-2019-episode- 5-api-breaches-and-the-visibility-problem

text: “2020 Cyber Threats, Business Email Compromise.” October 22, 2019.

text: Sara Boddy, Remi Cohen. “Regional Threat Perspectives, Fall 2019: Asia.”2019. F5 Labs.

text: in ETL 2020

text: A summary on the cybersecurity trends for the period between January 2019 and April 2020.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence.

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

identifier: ENISA Threat Landscape 2020 - Web application attacks

nummer: web-application-attacks

text: ENEN From January 2019 to April 2020

text: Web application attacks

text: ENISA Threat Landscape

text: Overview

text: Web applications and technologies have become a core part of the internet by adopting different uses and functionalities. The increase in the complexity of web application and their widespread services creates challenges in securing them against threats with diverse motivations from financial or reputational damage to the theft of critical or personal information. Web services and applications depend mostly on databases to store or deliver the required information. SQL Injection (SQLi) type of attacks are a well-known example and the most common threats against to such services. Cross-site scripting (XSS) attacks are another example. In this type of attack, the malicious actor misuses weaknesses in forms or other input functionalities of web applications that leads to other malicious features such as being redirected to a malicious website.

text: While organisations are becoming proficient and developing more consistent automation in their web application lifecycle, they are demanding security as the most crucial part of their offering and prioritisation. This introduction of complex environments drives the adoption of new services such as Application Programming Interfaces (APIs). APIs, which create new challenges for web application security the organisations involved to consider more prevention and detection measures. For instance, roughly 80% of organisations adopting APIs deployed controls on their ingress traffic. In this section, we review the threat landscape of web applications during 2019.

text: 20%_of companies and organisations reported DDoS attacks on their application services on a daily basis

text: Buffer overflow was the most common technique used (24%). HTTP flood (23%), resource reduction (23%), HTTPS flood (21%) and Low Slow 21% were other commonly used techniques.

text: 63%_of respondents to CyberEdge survey are using a web application firewall (WAF)

text: 27,5% have plans to deploy this technology and 9,5% do not have any such plans.

text: 52%_increase in the number of web application attacks in 2019 compared with 2018

text: According to a security researcher, the amount of web application attacks were almost flat compared with 2018 and rose sharply later in the year.

text: 84%_of observed vulnerabilities in web applications were security misconfigurations

text: This was followed by cross-site scripting (53%) and broken authentication interestingly (45%).

text: Kill chain

text: Web application attacks

text: Reconnaissance Weaponisation Delivery Exploitation

text: Command & Actions on Installation Control Objectives

text: Description

text: _Improved collaboration between application security and application development

text: According to the survey conducted by a security researcher , one of the factors contributing to such ineffective security could be the decisionmaking about ownership of security tools. The survey presented the views of top influencers in this area naming IT leadership and business owners and not the chief information security officer (CISO).

text: _Growing importance of Application Programming Interfaces (APIs)

text: APIs are not new in web application architecture, and their widely accepted usage reintroduces existing risks and their likelihood of exploitation as a result of the widening of the threat landscape. Accordingly, the Open Web Application Security Project (OWASP) published a top 10 list of API security measures 6 providing a prioritised way to secure such capability in web application architecture. One instance of such a threat is the PHP API attacks: according to another security researcher, 87% of the scanning of API traffic was searching for available PHP APIs.

text: _Authorisation and authentication failures

text: These are usually the leading cause of malicious actors gaining access to critical information (i.e. fast retailing breach ). According to a security researcher, the breaches of critical data are the second most pressing threat to web application security.

text: _Growing trend with SQL injection (SQLi)

text: A recent security research identified that, two-thirds of web application attacks include SQLi attacks. While other web application attack vectors either remained steady or are growing, SQLi attacks continued to grow sharply, and particularly specially escalated during the holiday season of 2019. The findings from this research also identified that the finance industry faces more local file inclusion (LFi) attacks compared with other sectors.

text: 292 200 168 147 92

text: Attack vectors

text: _Web application attack vectors

text: There is general perception that web application attacks are quite diverse. However, data from security research suggests that the majority of web 11,13,14 application attacks are limited to SQLi or LFi. Another report suggests that SQLi, directory traversal, XSS, broken authentication and session management are on the top of the attack vectors used in this type of attacks. SONICWALL also reported a similar trend for the top web application attacks for 2019. On the list SQLi, directory traversal, XSS, broken authentication and session management were on the top.

text: _Web application attacks

text: 6 2018 2019 5

text: 4 )

text: 0 JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC

text: Mitigation

text: _Proposed actions

text:  Use input validation and isolation techniques for injection type attacks (i.e. parameterised statements, escape user input, input validation, etc.) .  Implement web application firewalls for preventive and defensive measures17 (also known as virtual patching ).  For web application APIs :  implementing and maintaining an inventory of APIs and validating them against perimeter scans and internal discovery through development and operational teams;  encrypting API communication and connection;  providing the right authentication mechanisms and authorisation levels.  Incorporate application security processes into the application development and maintenance life-cycle.  Restrict access to inbound traffic for required services only.  Deploy traffic and bandwidth management capabilities.  Enforce web application server hardening and maintain a good patch management and testing processes.  Perform vulnerability and risk assessments before and during the web application development.  Conduct regular penetration testing during implementation and after deployment.

text: _Web applications by maximum severity of vulnerabilities found

text: 100% 90% 80% 70% 60% High 50% Medium 40% Low 30% 20% 10% 0%

text: 2015 2016 2017 2018 2019

text: References

text: “The increase in the complexity of web application and their widespread services creates challenges in securing them against threats with diverse motivations from financial or reputational damage to the theft of critical or personal information.”

text: Related

text: ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: About

text: _ The agency

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contributors

text: Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

text: Editors

text: Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

text: Contact

text: For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-354-4 DOI: 10.2824/552242

type: vagledning

utgivare: enisa


text: in ETL 2020

text: Step of Attack Workflow

text: Width of Purpose

text: The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker.

text: MORE INFORMATION

text: Figure 1: Percentage distribution of ShadowGate per country

text: in ETL2020

text: “Watering Hole” Proofpoint. https://www.proofpoint.com/uk/threat-reference/watering-hole

text: “What Is a Drive-By Download?” Kaspersky. https://www.kaspersky.com/resourcecenter/definitions/drive-by-download

text: “Formjacking: Major Increase in Attacks on Online Retailers”, Broadcom. https://symantecenterprise-blogs.security.com/blogs/threat-intelligence/formjacking-attacks-retailers

text: “What is Formjacking and How Does it Work?”, Norton. https://us.norton.com/internetsecurityemerging-threats-what-is-formjacking.html

text: “Magecart’s 7 Groups: Hackers Dropping Counter-Intelligence Code in JavaScript Skimmers”.

text: November 14, 2018. CBR. https://www.cbronline.com/in-depth/magecart-analysis-riskiq

text: “How Magecart’s Web-Based Supply Chain Attacks are Taking Over the Web “. March 10, 2019.

text: CBR. https://www.cbronline.com/analysis/riskiq-magecart-supply-chain-attacks

text: “CVE-2018-8174 Detail” September 5, 2019. NIST. https://nvd.nist.gov/vuln/detail/CVE-2018- 8174

text: “Join a Slack workspace”. Slack. https://slack.com/intl/en-gb/help/articles/212675257-Join-a- Slack-workspace

text: “New SLUB Backdoor Uses GitHub, Communicates via Slack” March 7, 2019.Trend Micros.

text: “Security Researchers Partner With Chrome To Take Down Browser Extension Fraud Network

text: Affecting Millions of Users” February 13, 2020. Cisco Duo Security. https://duo.com/labs/research/crxcavator-malvertising-2020

text: “Mac threat detections on the rise in 2019” December 16, 2019. Malware Bytes.

text: “File Cabinet”, Google. https://sites.google.com/site/tiesitestutorial/create-a-page/file-cabinet

text: Google Sites. https://sites.google.com/site/

text: “Talos ShadowGate Take Down: Global Malvertising Campaign Thwarted” September 1, 2016.

text: “New Bizarro Sundown Exploit Kit Spreads Locky” Trend Micro.

text: “Incoming! Multiple Popular Websites Attacked for Cryptocurrency Mining via GreenFlash

text: Sundown Exploit Kit” 360 Blog. https://blog.360totalsecurity.com/en/incoming-multiple-popularwebsites-attacked-cryptocurrency-mining-via-greenflash-sundown-exploit-kit/

text: “ShadowGate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit

text: Kit” June 27, 2019. Trend Micro. https://blog.trendmicro.com/trendlabs-securityintelligence/shadowgate-returns-to-worldwide-operations-with-evolved-greenflash-sundownexploit-kit/

text: “GreenFlash Sundown exploit kit expands via large malvertising campaign” June 26, 2019.

text: Malware Bytes. https://blog.malwarebytes.com/threat-analysis/2019/06/greenflash-sundownexploit-kit-expands-via-large-malvertising-campaign/

text: “FAQ about SA-CORE-2018-002” March 28, 2018. Drupal.

text: “Drupalgeddon2 still used in attack campaigns” October 7, 2019. Akamai.

text: “Trustwave Global Security Report 2019”, 2019. Trustwave.

text: “Stable Channel Update for Desktop” October 31, 2019.

text: ” Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium”. November 1, 2019.

text: Kaspersky. https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operationwizardopium/94866/

text: “CVE-2019-13720 flaw in Chrome exploited in Operation WizardOpium attacks” November 1,

text: 2019. Security Affairs. https://securityaffairs.co/wordpress/93278/hacking/cve-2019-13720lazarus-attacks.html

text: “Web Browser-Based Attacks”. Morphisec.

text: “The 5 most common cyber attacks in 2019”. May 9, 2019. IT Governance.

text: “Exploit Kits: Their Evolution, Trends and Impact”. November 7, 2019. Cynet.

text: “Web-Based Threats: First Half 2019”. November 1, 2019. Palo Alto.

text: “Mitigating Drive-by Downloads” April 2020. ACSC.

text: “MITRE ATT&CK: Drive-by compromise” December 5, 2019. MITRE.

text: “Protecting users from web-based attacks with browser isolation” September 26, 2019. Shi

text: Blog – Security Solutions. https://blog.shi.com/solutions/protecting-users-from-web-basedattacks-with-browser-isolation/

text: skimming-payment-card-data-hits-big-time?es_p=9346257”. April 11, 2019. Broadcom. https://symantec-enterprise-blogs.security.com/blogs/feature-stories/istr-2019-cyber-skimmingpayment-card-data-hits-big-time?es_p=9346257

text: A summary on the cybersecurity trends for the period between January 2019 and April 2020.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence.

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

identifier: ENISA Threat Landscape 2020 - Web-based attacks

nummer: web-based-attacks

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: ENISA Threat Landscape 2020 - Web-based attacks

serie: rapporter

text: ENEN From January 2019 to April 2020

type: rubrik

text: Web-based attacks

text: ENISA Threat Landscape

text: Overview

text: Web-based attacks are an attractive method by which threat actors can delude victims using web systems and services as the threat vector. This covers a vast attack surface, for instance facilitating malicious URLs or malicious scripts to direct the user or victim to the desired website or 1 2 downloading malicious content (watering hole attacks , drive-by attacks ) and injecting malicious code into a legitimate but compromised website to steal information (i.e formjacking ) for financial gain, information stealing or even extortion via ransomware. In addition to these examples, internet browser exploits and content management system (CSM) compromises are important vectors observed by different research teams being used by malicious actors.

type: stycke

text: Brute-force attacks, for example, target an operating by overwhelming a web application with username and password login attempts. Webbased attacks can affect the availability of web sites, applications and application programming interfaces (APIs), breaching the confidentiality and integrity of data.

text: Kill chain

text: Web-based attacks

text: Reconnaissance Weaponisation Delivery Exploitation

text: Command & Actions on Installation Control Objectives

text: Trends

text: _Across the board

text:  FORMJACKING MALWARE STEALING USER DATA. Injecting malicious code into websites is a well-known technique used by cybercriminals. Formjacking has been previously reported mostly in cryptocurrency mining activities. However, according to a security researcher , malicious actors are moving to user data and banking details using this technique. The websites targeted remained infected on average for 45 days. During May 2019, this security researcher reported the blocking of nearly 63 million malicious web requests related to formjacking.  ‘MAGECART’ GOES BEYOND BY TARGETING SUPPLY CHAIN. According to a security researcher, one of French digital media companies was targeted by the malicious actor Group12, which infected the site’s advertising inventory, delivering skimmer code and infecting thousands of websites hosting the advertisement. It was observed that this group’s operation was made more effective by setting up their skimming infrastructure just a few months before starting the campaign. Thus, an end-user could become infected only by visiting a website hosting this advertisement.  WEB-BASED COLLABORATION AND MESSAGING PLATFORMS. These are becoming the bridge between malicious actors and victims on what is called the SLUB backdoor. During March 2019, a security researcher came across a campaign that was using watering hole attacks to infect victims by exploiting the vulnerability CVE-2018-81747. The attack involved multi-stage infection schemes. One example of how these schemes work is downloading a DLL file, using a PowerShell to execute it, downloading the malware and running the main backdoor. Interestingly, the malware was connecting to a Slack workspace messaging service to send the command results, which were delivered through a GitHub Gist snippet in which potentially the attacker was 7,8 adding commands.

text:  BROWSER EXTENSION, FRAUD AND MALVERTISING. A security researcher uncovered a widespread malvertising campaign using Google Chrome extensions affecting approximately 1,7 million users. These Chrome extensions were obfuscating the underlying advertising feature from the end-users to ultimately keep the infected browser connected to the C2 infrastructure. The security researcher concluded that the campaign increased activity between the months of March and June 2019, despite suspicions that it was active long before that. Another security researcher observed that NewTab adware activity, which facilitates browser extensions, increased at the end of 2019.  GOOGLE SITES USED FOR HOSTING DRIVE-BY PAYLOAD. The malware known as ‘LoadPCBanker’ (Win32.LoadPCBanker.Gen) was found in Google Sites file cabinets template (Classic Google Sites). According to a security researcher, the actor first used the Classic Google Sites to create a webpage and subsequently facilitated the file cabinets template to host the payloads. Then it used the SQL service as the 12,13 exfiltration channel to send and store victim data.  RANSOMWARE USING ONLINE VIDEO CONVERTER AS A DRIVE-BY

text: DOWNLOAD MECHANISM. According to a security researcher,

text: ShadowGate or the WordJScampaign has been active since 2015, targeting advertising software and websites. During 2016, the Greenflash Sundown exploit kit was developed to enhance the activity of the campaign by injecting the kit into compromised advertisement services and spreading ransomware. During 2018, ShadowGate was spotted delivering crypto-miners to servers in East Asia for a short time. The distribution of ShadowGate per country is presented in Figure 1 of this report. Another security researcher also reported the activity, which was tracked back to onlinevideoconverter[.com] as one of the main 14,15,16,17,18 drive-by websites for delivering the exploit kit.

text: Trends

text: _Across the board

text:  CONTENT MANAGEMENT SYSTEMS ARE STILL AN IDEAL TARGET. Considering the popularity of Content Management Systems (CMS) among internet users, these systems are an attractive target for malicious actors. A security researcher identified an increase in the exploitation of a vulnerability identified during 2018 (Drupalgeddon2 ) targeting the Drupal platform. Similarly, another security researcher observed an trend in WordPress exploitations targeting vulnerabilities 19,20 and outdated third-party plugins.

text:  INTERNET BROWSER EXPLOITS USED IN WATERING HOLE ATTACKS. A threat actor was seen perpetrating a watering hole attack using a Korean Language news portal. In this attack, a malicious script (JavaScript) was injected into the home page of a website automatically (leveraging a second script) by checking the victim’s browser, and subsequently exploiting a Google Chrome vulnerability CVE-2019-13720. Furthermore, a new version of SLUB backdoor malware was found to be infecting the victim’s browser (Internet Explorer vulnerability CVE-2019-0752 ) using a specific watering hole website during July 2019. In a different investigation, the security team from the software developer identified a set of compromised websites that were used in watering hole attacks exploiting iPhone 21,22 vulnerabilities.

text: Japan

text: 2% 4%

text: Italy

text: Germany

text: Total

text: United States

text: 54% 10.032

text: Taiwan

text: Others

text: Attack vectors

text: _ How

text:  DRIVE-BY DOWNLOADS. This attack vector downloads malicious contents to the victim’s device. In this type of attack, the end-user needs to visit the legitimate website that has been compromised. This can be achieved by using malicious scripts injected into the legitimate website, running browser-based exploits or redirecting the user to a 25,26 compromised website behind the scenes.  WATERING HOLE ATTACKS. This technique is used for targeted attacks using exploit kits with stealth features. In other words, it is the type of attack used when a malicious actor is interested in compromising a specific user group using exploits or other malicious content (i.e. scripts or advertisements) injected into the website.  FORMJACKING. In this technique, malicious actors inject malicious code into legitimate website’s payment forms. This attack mostly captures banking and other personal identifiable information (PII). In such scenario, the user enters their banking details or card data into the ecommerce payment portal. Once the information has been collected and submitted, the malicious script will simultaneously forward the data to the portal and to the malicious actor. This information is then used for various criminal purposes: financial gain, extortion and selling it in 3,4 the dark markets.  MALICIOUS URL. This is defined as a link created with the intention of distributing malware or facilitating a scam. The process involves socially engineering the victim’s information to persuade them to click on the malicious URL, which delivers the malware or malicious content and compromises the victim’s machine.

text: __ Operation WizardOpium

text: A Google Chrome zero-day vulnerability was has been found in the wild in targeted web-based attacks. The flaw, registered as CVE-2019-13720, affects versions earlier than 78.0.3904.87 on Microsoft Windows, Mac and Linux systems. The defect lies in the audio component of the web browser and its successful exploitation could result in arbitrary code execution.

text: The zero-day vulnerability, discovered by a security researcher and registered as CVE-2019-13720, was not attributed to any specific threat actor but seen as part of a campaign tracked as Operation WizardOpium. In the meantime Google has released an updated for Chrome version 78.0.3904.87. According to the researcher, the attack takes advantage of a watering-hole style injection on a Korean-language news portal. A malicious JavaScript code inserted into the landing page enables the 23,24 profiling script to be loaded from a remote site.

text: Browser exploits are a form of exploitation using malicious code that uses weaknesses and vulnerabilities in the software (operating system and browser) or related plugins to ultimately gain access to the victim’s device.

text: Mitigation

text: _Proposed actions

text:  Follow a good patch management process and plan;

text:  update the internet browser and related plugins to keep them up to date and patched against known vulnerabilities;

text:  keep the content management system (CMS) based pages and the portal patched to avoid unverified plugins and addon’s;

text:  make sure that endpoints and installed software are updated, patched and protected.

text:  Isolate applications (application whitelisting) and create a sandbox to reduce the risk of drive-by-compromise attacks. For instance, the browser isolation technique can protect the endpoints from browser 29,30,31 exploitation and drive-by-compromise attacks.

text:  For website owners, hardening servers and services is a proactive approach to mitigate web-based attacks. This includes controlling the version of the content scripts as well as scanning locally hosted files and scripts for the web server or service.

text:  Restricting web-based content is another technique for protecting against web-based attacks. Facilitating tools such as adblockers or JavaScript blockers will also limit the possibility of executing malicious 29,30 codes while visiting specific websites.

text:  Monitor web e-mail and filter content for detecting and preventing the delivery of malicious URLs and files/payloads.

text: “Web-based attacks typically include techniques such as SQL injection, parameter tampering, cross-site scripting, path traversal, and brute force to compromise a system or an application.”

text: References Related

text: About

text: _ The agency

text: Contributors

text: Editors

text: Contact

text: Legal notice

text: Regulation (EU) No 526/2013

text: Copyright Notice