2.2 Explain common threat vectors and attack surfaces

What kind of threat vector is associated with email, SMS and IM?

These are considered Message Based threat vectors because some sort of message is sent from an attacker to you by using one of these ways.

What is an image based threat vector?

This type of attack involves adding malicious code embedded in an image. When a user opens up this image, that code is ran automatically. This uses steganography to perform this since it’s hiding a message inside a picture.

What is Vishing?

This is a term used to describe a phishing attack over the phone. The attacker will call to request information for fake reasons in hopes you will give up this information over the phone.

What is a Vulnerable software threat vector?

This type of vector refers to software that can be exploited due to a vulnerability that can either be misconfigured, out of date or using default credentials. These can either be client based meaning an agent has to be installed on the device and that agent being vulnerable or by agentless to where nothing is installed on devices, but compromised software on the server would compromise all devices using it.

Why are open service ports a concern in a network?

Every application has to use a service port to work properly. The more applications or services you use, the more ports that are opened up on the network. This provides an attacker an opportunity to gain access by using one of these open ports on your network. Firewall rules must be placed and configured correctly to ensure the open ports can’t be accessed by anyone from anywhere.

What is a supply chain threat vector?

This type of threat vector includes the specific method or pathway used by attackers to compromise a target organization through its supply chain. So for an MSP, if the MSP gets compromised, the attacker would have access to all their clients and their network. This can also affect hardware to where if a manufacturer is unaware that several devices have been tampered with and deployed, the attacker would have access once installed.

What is pretexting?

This is a social engineering attack term by threat actors to gain trust, data, or access to accounts using a fabricated story, or pretext.

What is a watering hole attack?

This kind of attack is where the attacker will compromise a trusted website by having malicious code embedded into the website. The attacker has to figure out which sites their victims will most likely visit in order to achieve this. Once they visit the site, the code downloads to their PC which will gives the attacker access at this point.