I'm very curious too, I wonder why this "waterhole" has not been publicly revealed yet? It would make it easier for others to identify whether they were exposed, and take the necessary actions to secure their workstations.
Even browser updating automatically aren't a panacea: the update itself may be corrupted by an exploit (now that would be a fiasco).
That is precisely the reason people should surf from a separate user account, using very strict firewalling rules.
"iptables -I OUTPUT -p tcp --dport 80 (and 443) -m state --state NEW -m user --user-id 501 -j ACCEPT"
Now it's too bad per-user firewalling cannot be done easily on neither Windows nor OS X.
It's also too bad one user (say the one allowed to surf the Web) cannot display its browser window(s) in another user (say your main account)'s graphical display (neither on Windows nor on OS X).
Or too bad OS X doesn't allow to run two graphical sessions simultaneously (on some version of Windows, if you pay enough, at least you can do that).
All this is trivial to do under Linux.
I'm feeling better and better using Linux as my desktop.
(Amazing, because look what you've done! Terrible, because almost every other human on this planet could not accomplish your outcome even with guides and training...)
Now it's too bad per-user firewalling cannot be
done easily on neither Windows nor OS X.
It's also too bad one user (say the one allowed
to surf the Web) cannot display its browser window(s)
in another user (say your main account)'s graphical
display (neither on Windows nor on OS X).
$ /Applications/Safari.app/Contents/MacOS/Safari
Seems to work for me.
Or too bad OS X doesn't allow to run two graphical
sessions simultaneously
uid user
Match all TCP or UDP packets sent by or received for a
user. A user may be matched by name or identification
number.
In the same way a stubborn mathematical proof is trivial, I'm sure.