(2) Endpoint Threats and Attack Vectors

Software-Based Threats

❑ Virus ❑ Worm ❑ Trojan❑ Ransomware ❑ Spyware

Hardware-Based Threats

❑ Malicious ❑ Juice Jacking ❑ Supply Chain Attacks

Malware

Malicious code designed to infect a system

Ransomware

specifically encrypts files and demands payment for the decryption key.

Virus

Attaches to legitimate file and Attaches to legitimate file

Worm

Self-replicates automatically

Trojan

Disguised as legitimate software

Ransomware

Demands payment

Spyware

Steals sensitive data

Malicious USB Devices

Attackers leave "lost" USB drives in public areas. Once plugged in, these can act as a "Human Interface Device" (HID) to inject keystrokes or install backdoors.

Juice Jacking

Compromised public USB charging stations can secretly steal data or install malware while the device is charging

Supply Chain Attacks

This occurs when a component (like a microchip or firmware) is tampered with during the manufacturing or shipping process before it even reaches the end-user.

Insider Threats

originates from within the organization being targeted. Unlike external hackers who must "break in," an insider already has legitimate access to the network, applications, or physical facilities

Phishing/Smishing

Emails or SMS messages designed to look like they are from a trusted source, tricking users into clicking malicious links or providing credentials

Business Email Compromise (BEC)

tacker poses as a high-level executive or a known vendor to trick an employee into transferring funds or sensitive data

Pretexting

An attacker creates a fabricated scenario (e.g., "I'm from the IT help desk and we need to reset your password") to gain access to a system

Tailgating

A physical threat where an unauthorized person follows an employee into a restricted area or a secure office

Man-in-the-Middle (MitM)

An attacker intercepts communication between the endpoint and the server. This is common on unsecured public Wi-Fi.

Rogue Access Points

Attackers set up a Wi-Fi network with a name similar to a legitimate one (e.g., "Airport_Free_Wifi"). When users connect, all their traffic is visible to the attacker.

DNS Hijacking

Redirecting a user's traffic from a legitimate site to a malicious one by compromising the DNS settings on the endpoint or the router

Unsecured IoT Connections

Smart devices (printers, cameras, sensors) often have weak default security, serving as an easy entry point into the wider network

Defense-in-Depth for Endpoints

Protection layers: ❑User awareness training ❑Email filtering ❑Antivirus ❑EDR (Endpoint Detection and Response) ❑Firewall ❑Encryption ❑Monitoring No single tool is enough.