Section 3.26 Threat Vectors and Attack Surfaces

Question 1

Threat Vector

Answer 1

Means or pathway by which an attacker can gain unauthorized access to a computer or network to deliver a malicious payload or carry out an unwanted action

Think of threat vector as the “how” of an attack, whereas the attack surface is the “where” of the attack

Question 2

Attack Surface

Answer 2

Encompasses all the various points where an unauthorized user can try to enter data to or extract data from an environment

Think of threat vector as the “how” of an attack, whereas the attack surface is the “where” of the attack

Question 3

3 points RRD

How to minimse attack surface?

Answer 3

1. Restricting access
2. Removing unnecessary software
3. Disabling unused protocols

Question 4

6 Threat vectors that could be used to attack your enterprise network. MIFVRU

Threat vectors

Answer 4

1. Messages: Threats delivered via email, simple message service (SMS text messaging), or other forms of instant
   messaging
2. Images: Embedding of malicious code inside of an image file by the threat actor
3. Files: The files, often disguised as legitimate documents or software, can be
   transferred as email attachments, through file-sharing services, or hosted
   on a malicious website
4. Voice calls: Vishing - Use of voice calls to trick victims into revealing their sensitive information to an attacker
5. Removable devices: One common technique used with removable devices is known as baiting. Attacker might leave a malware-infected USB drive in a location where their target might find it, such as in the parking lot or the lobby of the targeted organization
6. Unsecure Networks: Unsecure networks includes wireless, wired, and Bluetooth networks that lack the appropriate security measures to protect these networks

Question 5

Unsecured Networks:
Wireless networks

Answer 5

If wireless networks are not properly secured, unauthorised individuals can intercept the wireless communications or gain access to the network

Attackers can set up rogue access points known as ‘evil twins’ to create fake wifi networks that mimic organisations legit ones. Once connnected the data can be intercepted/modified

Question 6

Unsecured Networks:
Wired networks

Answer 6

Wired networks tend to be more secure than their wireless networks, but they are not immune to threats

Physical access to the network infrastructure can lead to various
attacks

1. MAC Address Cloning
2. VLAN Hopping

Question 7

Bluetooth Vulnerability

Answer 7

By exploiting vulnerabilities in the Bluetooth protocol, an attacker can carry out their attacks using techniques like the BlueBorne or BlueSmack exploits

Question 8

BlueBorne

Answer 8

Set of vulnerabilities in Bluetooth technology that can allow an attacker to take over devices, spread malware, or even establish an on-path attack to intercept communications without any user interaction

Question 9

BlueSmack

Answer 9

Type of Denial of Service attack that targets Bluetooth-enabled devices by sending a specially crafted Logical Link Control and Adaptation Protocol packet to a target device