Examkin

Soru

Zorluk: OrtaSocial Engineering Attacks and Vectors

During a routine security audit, an incident handler observes that several software developers in a research division were redirected to a compromised third-party technical discussion forum they frequently visit. The compromised forum silently downloaded a malicious browser extension to harvest API tokens used in the company's continuous integration pipeline. Which of the following social engineering techniques best describes this initial access vector?

  1. Watering hole attackCevap
  2. B
    Spear phishing
  3. C
    Typosquatting
  4. D
    Influence principle of social proof

Cevap

Watering hole attack
A watering hole attack occurs when an adversary anticipates the web resources a specific target group frequents, compromises one or more of those websites, and uses them to infect visitors from the target organization.

Adım Adım Çözüm

1
Analyze the attack delivery medium described in the scenario.
The attack compromised a legitimate third-party website (a technical discussion forum) that a targeted group (research division developers) routinely visits.
Identifying whether the attack used direct communication, physical devices, or a shared compromised web resource determines the specific attack vector.
2
Compare the scenario details against social engineering attack definitions.
Compromising a specific site frequented by targets to deliver malware without direct message interaction defines a watering hole attack.
Watering hole attacks leverage implicit trust in established community resources rather than direct email or telephone solicitation.

Anahtar Kavram

Watering Hole Attack Identification
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Social Engineering Attacks and Vectors

Bu konudan daha fazla soru