An employee from the accounting department logs in to a website. A desktop application automatically downloads on the employee's computer. Which of…

The scenario describes a watering hole attack. This is a targeted attack where an adversary compromises a legitimate website that is frequently visited by a specific group of users—in this case, employees from the accounting department. The goal is to infect the computers of these targeted individuals when they visit the compromised site, which they trust. The automatic download of a desktop application upon visiting the site is the method of malware delivery, a common outcome of a successful watering hole attack, often referred to as a drive-by download.

A. XSS: Cross-Site Scripting (XSS) is a specific web vulnerability that injects malicious scripts into a website, not the overall strategy of targeting a group via a compromised site.

C. Typosquatting: This attack relies on users mistyping a URL and landing on a malicious site with a similar name. The scenario implies the employee visited a known, legitimate website.

D. Buffer overflow: This is a specific type of software vulnerability that exploits memory management errors. It describes how an exploit might function, not the attack delivery method.

1. MITRE. (2023). Drive-by Compromise

T1189. MITRE ATT&CK®. Retrieved from https://attack.mitre.org/techniques/T1189/. The document states

"This technique is also known as 'watering hole' when the compromise is targeted to a specific organization or group of users."

2. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide. NIST Special Publication 800-61 Rev. 2. https://doi.org/10.6028/NIST.SP.800-61r2. Section 2.3.2

"Attack Vectors

" describes the "Website" vector where visiting a malicious or compromised page causes malicious code to be downloaded

which aligns with the mechanism of a watering hole attack.

3. Lee

C.

& Paik

J. (2019). A Study on the Advanced Watering-Hole Attack and Its Countermeasures. Journal of The Korea Institute of Information Security & Cryptology

29(1)

155-164. https://doi.org/10.13089/JKIISC.2019.29.1.155. This paper defines a watering hole attack as a method where "an attacker infects a website that is frequently visited by a specific group... to distribute malware."