Initiating an attack against targeted businesses

and organizations, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection. The attackers run exploits on well-known and trusted sites likely to be visited by their targeted victims. Aside from carefull

y choosing sites to compromise, these attacks are known to incorporate zero-day exploits that target unpatched vulnerabilities. Thus, the targeted entities are left with little or no defense against these exploits.

What type of attack is outlined in the

scenario?

A. Watering Hole Attack

B. Heartbleed Attack

C. Shellshock Attack

D. Spear Phising Attack

Watering Hole is a computer attack strategy, in which the victim is a particular group (organization, industry, or region). In this attack, the

attacker guesses or observes which websites the group often uses and infects one or more of them with malware. Eventually, some member of the targeted group gets infected.

Incorrect Answers:

B: Heartbleed is a security bug disclosed in April 2014 in the O

penSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. Heartbleed may be exploited regardless of whether the party using a vulnerable OpenSSL instance for TLS is a server or a client. It results f

rom improper input validation (due to a missing bounds check) in the implementation of the TLS heartbeat extension, thus the bugs name derives from -heartbeat-.

C: Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Ba

sh shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary comman

ds. This can allow an attacker to gain unauthorized access to a computer system.

D: Spear phishing is an email or electronic communications scam targeted towards a specific individual, organization or business.

References: