Watering Holes vs. Spear Phishing

Watering-hole attacks have been established as an effective attack technique for a while now. As the industry has analyzed some prominent examples, many have come to the conclusion that watering-holes present an alternative to spear phishing.

The recently released Symantec Internet Security Threat Report highlights this viewpoint, as it concluded:

“Targeted attacks no longer rely as heavily on spear-phishing attacks in order to penetrate an organization’s defenses. More recently the attackers have expanded their tactics to include watering-hole attacks, which are legitimate websites that have been compromised for the purpose of installing targeted malware onto the victim’s computer.”

FireEye also predicted at the end of last year that watering hole attacks and social media targeting would “supplant” spear phishing.

Language like this is provocative, stimulates discussion and generates page views, but to paraphrase Mark Twain, news of spear phishing’s death has been exaggerated.