Examkin

Question

Difficulty: Very hardSocial Engineering and Threat Types

An IT security analyst is investigating a breach where multiple compliance officers' workstations were infected with spyware simultaneously. Email security logs show no suspicious incoming messages, external USB storage devices are blocked via Group Policy, and physical access logs show no unauthorized entry. Analysis reveals that all affected personnel regularly visit a specific third-party industry news website, which had been secretly compromised to serve malicious scripts to site visitors. Which of the following attack types best describes this scenario?

  1. Watering hole attackAnswer
  2. B
    Spear phishing
  3. C
    USB baiting
  4. D
    Pretexting

Answer

Watering hole attack
A watering hole attack occurs when an attacker compromises a specific website frequently visited by a target organization or department, planting malware to infect users upon visit. In this scenario, since email logs showed no malicious emails and USB ports were disabled, the infection of multiple users via a frequented third-party news site precisely fits the definition of a watering hole attack.

Step-by-Step Solution

1
Analyze the attack vectors ruled out by the scenario constraints.
Email security logs rule out spear phishing; Group Policy rules out USB baiting; physical access logs rule out physical tampering.
Elimination of vector possibilities based on provided security logs and administrative controls.
2
Identify the common vulnerability exploitation method among all affected users.
All affected workstations visited a compromised third-party industry website frequented by the target department.
Determining the common origin of the malicious payload delivery.
3
Correlate the attack delivery method with CompTIA threat classifications.
Compromising a specific website known to be used by a targeted group to infect their systems is defined as a watering hole attack.
Matching threat behavior to standard security terminology.

Key Concept

Watering Hole Attack Identification
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic