Objective 2.2: Explain common threat vectors and attack surfaces
Security+ SY0-701 practice question
Over two weeks, workstations at three aerospace parts suppliers are infected with the same remote access trojan. Investigators find that none of the victims opened email attachments. Every infected user had recently visited the discussion forum of an aerospace industry association, and the forum had been modified to deliver an exploit to its visitors. Which attack vector BEST describes this campaign?
- Typosquatting
Typosquatting relies on users mistyping a domain and landing on a look-alike site the attacker registered. The victims reached the real association forum, which had itself been compromised.
- Watering hole(Correct)
Correct. The attacker compromised a legitimate site that this specific industry visits and used it to infect visitors, which is the defining pattern of a watering hole attack.
- Business email compromise
Business email compromise uses a compromised or spoofed business email account to trick staff, usually into payments or data disclosure. The investigation found no email involvement.
- Supply chain compromise through a shared vendor
A supply chain compromise reaches victims through software, hardware, or services they obtain from a vendor or provider. The association forum is not supplying anything to the victims; the users visited it as a website.
Explanation
In a watering hole attack, the attacker compromises a legitimate website that the target group is known to visit and waits for victims to come to it. It is effective against organizations that are hard to phish directly, because the users trust the site and visit it willingly. Here the shared factor among all victims is the industry forum, not email or a supplier relationship.