Examkin

Question

Difficulty: Very hardSocial Engineering and Threat Types

A tier 2 helpdesk technician receives multiple incident reports from accounting personnel stating that when navigating to an industry-specific news and regulatory updates website they visit daily, their web browsers display certificate warnings and attempt to redirect them to a fake single sign-on portal. Upon investigation, the technician confirms that internal corporate DNS server records and local workstation hosts files are unmodified and accurate. Further forensic analysis reveals that malicious code was injected directly into the external news site to target visitors originating from the company's public IP address range. Which of the following security threat types is demonstrated in this scenario?

  1. Watering hole attackAnswer
  2. B
    Pharming
  3. C
    Typosquatting
  4. D
    Pretexting

Answer

Watering hole attack
The correct answer identifies a watering hole attack. In this attack vector, adversaries compromise a third-party website known to be regularly visited by employees of a targeted organization. Because internal DNS and local host settings remain untouched, the malicious redirection originates directly from the compromised external site targeting visitors from specific corporate IP blocks.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario.
The target website is a legitimate, trusted external site frequently visited by the specific group of users (accounting department).
Threat actors strategically identify websites commonly trusted and frequented by their target organization.
2
Evaluate the technical findings and delivery mechanism.
DNS resolution and local host configurations are intact, proving the redirection originates from malicious code injected into the compromised third-party site targeting specific public IP addresses.
Watering hole attacks selectively serve malicious payloads or redirects based on the visitor's IP range or enterprise profile.
3
Identify the matching social engineering/threat classification.
Compromising a common trusted resource to ambush specific organization members matches the definition of a watering hole attack.
This strategy bypasses traditional perimeter defenses by exploiting trust in an external resource.

Key Concept

Watering Hole Attack Identification
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic