Examkin

Question

Difficulty: HardSocial Engineering and Threat Types

A cybersecurity analyst is investigating an unauthorized network intrusion at a mid-sized engineering firm. System logs indicate that several high-level research engineers were infected with keylogger malware after visiting a legitimate, specialized computer-aided design (CAD) software forum that they frequently use for industry updates. Further analysis confirms the attacker compromised the forum site's web server beforehand to serve exploit code specifically targeting site visitors originating from the engineering firm's public IP address range. Which of the following social engineering threat types best describes this attack strategy?

  1. Watering hole attackAnswer
  2. B
    Whaling attack
  3. C
    Pretexting attack
  4. D
    Pharming attack

Answer

The attack strategy described is a watering hole attack because the attacker compromised a trusted third-party website routinely visited by the target group to deliver malware.
The correct answer is the option identifying a watering hole attack. In a watering hole attack, adversaries identify and compromise a trusted third-party website that members of a targeted organization frequently visit. Once the website is infected, visitors from the targeted organization are quietly served malicious code.

Step-by-Step Solution

1
Analyze the vector used to deliver the malware
The malware was delivered via a legitimate, trusted third-party industry forum that users visit regularly.
Identifying the medium helps distinguish between direct communication attacks and passive web-based exploits.
2
Evaluate the targeting mechanism
The attacker compromised the forum server in advance to target specific visitors coming from the organization's IP address range.
Watering hole attacks specifically target resources frequented by a particular group or organization.
3
Differentiate from alternative web and social engineering threats
Since DNS host resolution was not tampered with (pharming) and direct targeted email communication was not used (whaling), the incident represents a watering hole attack.
Watering hole attacks leverage preexisting trust in external web resources without needing to lure victims via direct phishing links.

Key Concept

Watering Hole Attack
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic