Attack Vectors - SY0-601 CompTIA Security+ : 1.5

Summary

This video explores various attack vectors used by cyber attackers to gain access to networks and systems. It covers direct access methods, such as exploiting physical hardware or installing keyloggers, and highlights wireless vulnerabilities like rogue access points and weak encryption. Email phishing, supply chain compromises, and social media data exploitation are also discussed as key avenues for cyberattacks. The video emphasizes the importance of securing hardware, networks, and cloud applications while demonstrating how attackers can exploit even the smallest vulnerabilities to compromise systems and steal sensitive information.

Takeaways

• 😀 Attack vectors are the methods attackers use to gain access to your network or systems, and they are constantly looking for vulnerabilities to exploit.
• 😀 Even a single vulnerability can give attackers access to the target system, so constant monitoring and patching of systems are essential for security professionals.
• 😀 Physical access to hardware increases the number of attack vectors, including bypassing security measures like administrative passwords or installing malicious devices like keyloggers.
• 😀 Attackers can exploit rogue access points or 'evil twins' in wireless networks to intercept and manipulate data sent by legitimate users.
• 😀 WPA2 encryption vulnerability (KRACK attack) in 2017 demonstrated the need for timely updates to wireless clients to mitigate security risks.
• 😀 Email remains a popular attack vector, with phishing and malware being used to steal personal information or compromise systems through social engineering.
• 😀 The supply chain is a critical attack vector, as seen in incidents like the Target breach, where attackers accessed networks through third-party vendors.
• 😀 Attackers may use social media data for social engineering, such as leveraging personal details to bypass security questions and gain unauthorized access to accounts.
• 😀 USB devices can be used to transfer data out of a network, even in air-gapped systems, through malicious devices that mimic keyboards or other trusted peripherals.
• 😀 Cloud-based applications present new attack vectors, such as misconfigurations that could expose data or be exploited by brute force attacks or denial-of-service attacks.

Q & A

What is an attack vector?

An attack vector is the method or path an attacker uses to gain unauthorized access to a computer or network. It represents the different ways an attacker might exploit vulnerabilities to breach security.

Why is physical access to a system a critical attack vector?

Physical access to a system is a critical attack vector because an attacker with physical access can directly manipulate the system's hardware, for example, by resetting passwords or inserting keyloggers to capture sensitive data.

How can keyloggers be used as an attack vector?

Keyloggers can be inserted into keyboards or USB devices, secretly recording all keystrokes typed by users. Attackers retrieve this data to obtain sensitive information like usernames and passwords.

What is an 'evil twin' in the context of wireless network attacks?

An evil twin is a rogue access point that mimics a legitimate network, tricking users into connecting to it. Once connected, attackers can intercept, alter, and steal data transmitted over the network.

How does the KRACK vulnerability affect WPA2 networks?

The KRACK (Key Reinstallation Attack) vulnerability allows attackers to intercept and decrypt data sent over WPA2-protected wireless networks. This vulnerability was quickly patched after its discovery in 2017.

Why is securing the supply chain important in cybersecurity?

Securing the supply chain is vital because each step in the process—from manufacturers to third-party vendors—can become a potential attack vector. An attacker might exploit vulnerabilities in any of these stages to compromise the network.

Can attackers use social media as an attack vector? How?

Yes, attackers can gather information from social media, such as birth dates, school names, and locations. This data can be used for social engineering attacks, including bypassing security questions to reset passwords and gain access to accounts.

What is the role of USB drives in data exfiltration attacks?

USB drives can be used to steal data from systems. Attackers might insert an infected USB drive into a system to copy sensitive files, or use USB devices that mimic keyboards to perform malicious actions without the user's knowledge.

What is a key security consideration when using cloud-based applications?

When using cloud-based applications, it's crucial to ensure that data is properly secured and that misconfigurations—such as improperly set permissions or open access—are avoided to prevent unauthorized access to sensitive information.

What are the risks of email as an attack vector?

Email is commonly used for phishing attacks, where attackers trick users into revealing personal information or clicking on malicious links. It can also be used to deliver malware or perform social engineering attacks like fake invoices.