2.2 Explain common threat vectors and attack surfaces

The idea

A threat vector is the path an attacker uses to reach you; the attack surface is the sum of all the places you can be reached. Reduce the surface (close ports, remove software, train users) and you remove vectors.

From class — threat vectors named: Direct access → they are physically right there. Supply chain → a motherboard gets a new (tampered) subcomponent, and so on down the chain. Cloud services. Plus artificial intelligence and zero-day vulnerabilities as emerging concerns.

Breakdown 1 — Technical vectors

Vector	What it is	Classic example
Message-based	Email, SMS, instant messaging	Phishing link, malicious attachment
Image-based	Malicious code or links hidden in images (steganography, SVG scripts, QR codes)	QR code that leads to a credential-harvesting page
File-based	Malicious documents/executables	Macro-enabled Word doc; double file extension invoice.pdf.exe shown as invoice.pdf
Voice call	Vishing	"This is the help desk, I need your password"
Removable device	USB drops, malicious cables	Found USB stick plugged into a workstation
Vulnerable software	Unpatched apps; client-based (agent installed) vs. agentless (scanned remotely)	Old browser plugin
Unsupported systems	End-of-life OS/apps with no patches	Windows 7 host on the LAN
Unsecure networks	Wireless (open Wi-Fi, evil twin), wired (unused live ports), Bluetooth	Attacker joins the guest Wi-Fi and pivots
Open service ports	Every listening service is a door	Telnet/RDP exposed to the internet
Default credentials	admin/admin never changed	IoT camera, router
Supply chain	MSPs, vendors, suppliers with access to you	Compromised software update; tampered hardware

From class: Double file extension → .pdf.exe displays as .pdf when Windows hides known extensions. Email security tip: "do not have the same extension" — block/rename risky attachment types. Know script extensions: .ps1 = PowerShell, .vbs = Visual Basic Script.

Breakdown 2 — Human vectors / social engineering

From class — why social engineering works: Authority, Intimidation, Consensus (social proof), Scarcity, Familiarity, Trust, Urgency. Impersonation → "like the help desk." Pretexting → a cover story ("like the FBI test").

Technique	What it is	Tell-tale sign
Phishing	Fraudulent email to steal credentials/deliver malware	Generic greeting, urgency, mismatched link
Spear phishing	Phishing aimed at a specific person/org	Uses your name, your project, your boss
Whaling	Spear phishing aimed at executives	"CEO" asks finance for a wire transfer
Vishing	Phishing by voice call	Caller ID spoofed to look internal
Smishing	Phishing by SMS	"Your package is held — click here"
SPIM	Spam over instant messaging	Unsolicited IM links
Business email compromise (BEC)	Attacker uses/spoofs a real business mailbox to redirect payments	Vendor "changed bank details"
Impersonation	Pretending to be someone trusted (help desk, vendor, police)	Requests that bypass process
Pretexting	Invented scenario that justifies the request	"I'm auditing accounts and need you to confirm your login"
Misinformation / disinformation	False info spread accidentally / deliberately	Influence campaigns
Watering hole	Compromise a site the targets already visit	"Put a trap on a very visited website"
Brand impersonation	Fake site/email mimicking a known brand	Look-alike logo, wrong domain
Typosquatting	Register a misspelled look-alike domain	paypa1.com, gooogle.com
Clickjacking (class)	Invisible frame over a page so clicks go somewhere else	"Framing" — the click count doesn't match what you see
Dumpster diving (class)	Physically searching trash for information	Old invoices, sticky notes
Tailgating vs. piggybacking (class)	Tailgating → the authorized person does not know someone slipped in. Piggybacking → the authorized person knowingly lets the unauthorized person walk in with them	Mantrap / access control vestibule defeats both

From class: Pharming → like phishing but done through DNS (poisoned DNS/hosts file redirects you to a fake site) instead of email. Salami attack → stealing a penny at a time so nobody notices.

Breakdown 3 — Reducing the attack surface

• Close/disable unused ports and services; remove unneeded software.
• Change default credentials; enforce MFA.
• Patch, and retire unsupported systems (or isolate them).
• Allow-list applications; block risky attachment types; SPF/DKIM/DMARC for email.
• Train users (5.6) — the human vector is still the most used.
• Vet the supply chain (5.3): vendor assessments, right-to-audit, signed updates.

Exam tip: Voice = vishing; text = smishing; IM = SPIM; exec target = whaling; DNS-based redirect = pharming; misspelled domain = typosquatting; compromised popular site = watering hole.

Quick self-check

• What's the difference between tailgating and piggybacking? (Whether the authorized person knows.)
• Why is a double extension dangerous? (Windows hides the real .exe.)
• Name three social-engineering pressure principles. (Authority, urgency, scarcity…)