your favorite websites can be HACKED! (watering holes, typo squatting) // FREE Security+ // EP 4

About this video

Part of NetworkChuck’s free Security+ series, this episode argues you are not safe even on sites and systems you trust. He explains watering hole attacks: instead of attacking each victim, hackers compromise a website the target group frequents — poisoning the shared watering hole — scan it for vulnerabilities, and infect visitors, sometimes with no download or click required. He cites Forbes’ Thought/Quote of the Day as an example, saying attackers used two zero-day vulnerabilities, one in Microsoft Internet Explorer and one in Adobe Flash Player, so merely visiting infected visitors. Next he covers typosquatting: registering misspelled domains like facemook.com or the notorious goggle.com to catch fat-finger typos and serve phishing pages, noting big sites try to buy or sue over such domains. Finally he explains email prepending: spam filters mark internal mail as trusted and external mail as ’external’ in the subject, but attackers can prepend ‘internal’ themselves to exploit conditioned trust. The lesson throughout is to stay vigilant precisely where you normally let your guard down.

Key takeaways

• Watering hole attacks compromise a trusted site your group visits, rather than attacking each person directly
• Some watering hole infections need no action from the visitor — the creator cites Forbes being exploited via zero-days in Internet Explorer and Flash Player
• Typosquatting registers common misspellings of popular domains to serve phishing or malicious pages to people who mistype URLs
• Email prepending defenses can be spoofed: attackers prepend ‘internal’ to external mail to borrow the trust users place in that label
• There is no fully safe place online — vigilance matters most on familiar sites, familiar domains, and routine email

Episode details: published November 17, 2020 · 10:17 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: i hacked my grandma (social engineering and pretexting) // FREE Security+ // EP 3 · Next: my beard isn’t real // FREE Security+ // EP 5 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube