In this lesson
we are going to cover the different concepts related
to threat vectors and attack surfaces.
Before we dive into the different threat vectors
that you should be aware of
we need to take a moment to define a threat vector
and an attack surface.
A threat vector refers to the means or pathway
by which an attacker can gain unauthorized access
to a computer or network
to deliver a malicious payload
or carry out an unwanted action.
The attack surface of a system or network on the other hand
encompasses all the various points
where an unauthorized user can try to enter data
or extract data from the environment.
Basically, this attack surface represents the sum
of all potential vulnerabilities
and entry points that an attacker could exploit.
I like to think of the threat vector
as the how of an attack
whereas the attack surface is the aware of the attack.
Now, when it comes to the attack surface
you can consider the whole network at once,
but it's often easier to break down the network
into smaller parts for analysis.
Then each of these attack surfaces can be minimized
by restricting access,
removing unnecessary software,
and disabling unused protocols
on the portion of the network
to significantly increase their security posture
of your networks.
For instance, the use of email and instant messaging
within an organization will expand its attack surface
since this provides additional avenues that could be used
as a part of a phishing campaign.
Similarly, the use of removable devices
or unsecured networks can also increase the attack surface
by introducing additional vulnerabilities
that an attacker could exploit.
So now that we understand some of the basics
of threat actors and attack surfaces,
let's take a look at several different threat vectors
that could be used to attack your enterprise networks,
including messages, images, files, voice calls,
removable devices,
and unsecure networks.
First, we have messages.
Message-based threat vectors include threats delivered
by email, short message service or SMS,
or other forms of instant messaging.
Phishing campaigns are commonly used as a part
of a message-based threat vector
where an attacker impersonates a trusted entity
to trick its victims
into revealing their sensitive information to the attacker.
These messages can also contain malicious links
or attachments to try and install malware, Trojans,
and viruses on a given system or network.
For example, if you receive an email stating
that you want a brand new iPhone,
and all you need to do is click on the link to open a form
so that you can provide your mailing information
for the phone to be shipped out to you,
you should be very wary
that this could be a message-based threat vector being used
as a part of a phishing campaign.
Second, we have images.
Image-based threat vectors involve the embedding
of malicious code inside of an image file
by the threat actor.
When the image is later opened or loaded
by the victim system,
the malicious code is executed
and this can potentially lead to data theft,
a system compromise,
or other types of malicious outcomes.
Back in 2017, cybersecurity researchers
discovered a large scale image-based attack
known as stegano.
In the stegano attack
cyber criminals embedded malicious codes within the pixels
of banner ads on so many popular websites
and the malicious code was designed
to exploit known vulnerabilities
in the older Internet Explorer web browser.
If a user visited a website that contained the banner ad
with the malicious code hitting within the banner ads image,
the code would be executed by the vulnerable web browser
and it would then redirect the user
to a site that hosted an exploit kit.
This exploit kit would then attempt to download
and install malware on the user's system
all without the user's knowledge
or any visible indication that this attack even occurred.
Third, we have files.
File-based threat vectors involve the use
of malicious files to deliver a cyber threat.
The files often disguised as legitimate documents
or software can be transferred as email attachments
through file sharing services
or hosted on a malicious website.
For example, if you try to avoid paying for a new video game
by downloading a cracked or pirated version of the game
from a website you found online,
the files within the downloaded game could potentially
include different types of malwares depending
on the motivations of the threat actor
who uploaded the file.
Fourth, we have voice calls.
Voice call based threat vectors,
also known as vishing, involves the use of voice calls
to trick victims into revealing their sensitive information
to an attacker.
The attacker may try to impersonate a trusted entity,
such as a bank or a service provider
to gain the victim's trust over the call.
For example, you may get unsolicited calls
to your cell phone from someone claiming to be
from the Internal Revenue Service
and if you don't provide them
with your social security number for identification purposes
or credit card information to pay a fine
that they will send agents to your house
to arrest you for non-compliance.
In reality, this is just an attacker trying to scare you
into providing your information
because the IRS does not call people directly
and instead would send you a formal letter in the mail
to collect any information or payments from you
if this was really the IRS.
Fifth, we have removable devices.
Removable device threat vectors refers to the threats
delivered via removable devices,
such as USB thumb drives
and externally connected storage devices
like hard disks and solid state devices.
One common technique used with removable devices
is known as baiting.
With baiting,
an attacker might leave a malware infected USB drive
in a location where their target might find it,
such as in the parking lot or the lobby
of the targeted organization.
If the target finds the device,
connects it to their computer system,
the malware will then be installed and executed.
Alternatively, some attackers may use
social engineering techniques
to get themselves into the office building
where they can then connect the removable device
on the system themselves in order to infect the system.
The exact malware and objectives used for the attack
will really depend on the attacker's
own motivations as well.
Six, we have unsecured networks.
Unsecured networks include wireless, wired,
and Bluetooth networks
that lack the appropriate security measures
to protect these networks.
Since the networks are unsecured
an attacker can exploit these networks
to intercept data to deliver malware
or to gain unauthorized access to connected devices.
Wireless networks such as wifi provide convenient
and flexible connectivity.
However, they also present a significant threat vector
for our enterprise networks.
If these wireless networks are not properly secured,
unauthorized individuals
can intercept the wireless communications
or gain access to the network.
For instance, attackers can set up rogue access points
known as evil twins to create fake wifi networks
that mimic an organization's legitimate ones.
When users connect to these fake wifi networks
their data can be intercepted, captured,
and modified based on the objectives
when conducting the attack.
Wired networks tend to be more secure
than their wireless counterparts,
but they are still not immune to threats.
Physical access to the network infrastructure can lead
to various attacks,
such as tapping into the network cables to intercept
and manipulate the data or connecting unauthorized devices
to the network by using Mac address cloning or VLAN hopping.
Bluetooth networks are widely used
for short range communications between devices
and they present us
with yet another threat vector that an attacker can exploit.
By exploiting vulnerabilities within the Bluetooth protocol
an attacker can carry out their attacks using techniques
like the BlueBorne or the BlueSmack exploits.
BlueBorne, for example, refers to a set of vulnerabilities
in the Bluetooth technology can allow an attacker
to take over devices, spread malware,
or even establish an on-path attack
to intercept communications
without any user interaction.
BlueSmack, on the other hand,
is a type of denial service attack
that targets Bluetooth enabled devices
by sending especially crafted logical link control
adaptation protocol packet to a target device
which can then consume all the available resources
on a targeted device
and causes it to crash or become inoperable.
So remember, a threat vector refers to the means
or pathway by which an attacker can gain unauthorized access
to a computer or network to deliver a malicious payload
or carry out an unwanted action.
The attack surface of the system
or network on the other hand
encompasses all the various points
where an unauthorized user can try to enter data
or extract data from an environment.
There are many different threat vectors
that an attacker could use against your enterprise networks,
including messages, images, files, voice calls,
removable devices,
and unsecured networks.
By better understanding the various paths used
by threat actors to infiltrate your enterprise network
you can help to develop a more effective defense,
implement the appropriate security policies,
and ultimately protect your organization's valuable data
and resources.