CompTIA Security+ SY0-701 Course - 2.2 Explain Common Threat Vectors and Attack Surfaces - PART A

Summary

This lesson delves into the exploitation of various communication methods by cyber attackers, including phishing, malware distribution, and steganography. It highlights the risks of message-based threats through emails, SMS, and instant messaging, as well as file-based threats and the dangers of voice impersonation and removable devices spreading malware. The importance of securing unsupported systems, networks, and default credentials is underscored, along with the threat of supply chain attacks. The lesson concludes with the necessity of regular assessments and proactive measures for robust cybersecurity.

Takeaways

• 📧 Email is a common platform for phishing attacks where attackers pretend to be legitimate entities to steal sensitive information.
• 📲 SMS and instant messaging are exploited for smishing attacks, often including malicious links that can spread malware or trick users into giving out sensitive data.
• 🔗 Image files can contain hidden malicious code through steganography, which can infect systems once opened, as seen in the 2017 Bad Rabbit ransomware attack.
• 📄 File-based threats involve malware embedded in documents or software, which can install malware on systems when users download or open these files.
• 🎙️ Voice calls can be used for vishing, impersonating legitimate entities to extract personal or financial information, as demonstrated by the IRS scam calls.
• 💾 Removable devices like USB drives are often used to spread malware, as in the case of the Stuxnet worm targeting Iranian nuclear facilities.
• 🚫 Unsupported systems and applications are at high risk as they no longer receive security updates, which was a vulnerability exploited by the WannaCry ransomware attack.
• 🔒 Unsecure networks, including wireless, wired, and Bluetooth, are susceptible to attacks like eavesdropping or man-in-the-middle, with public Wi-Fi being a common target.
• 🛑 Open service ports can be entry points for attackers, making regular port scanning and closing unnecessary ports essential security practices.
• 🔑 Devices or software with default credentials are prime targets for attackers, as seen in the Mirai botnet attack exploiting IoT devices with default passwords.
• 🔄 Supply chain threats occur when attackers target less secure elements in a network, such as the SolarWinds attack where malware was introduced through the software supply chain.

Q & A

What are the common types of message-based threats mentioned in the script?

The common types of message-based threats include phishing attacks through email, SMS, and instant messaging, where attackers masquerade as legitimate entities to extract sensitive information.

Can you provide an example of a ransomware attack that spread through phishing emails?

The 2017 WannaCry ransomware attack is an example that spread through phishing emails containing malicious attachments.

What is the term for hiding malicious code in image files, and how was it used in a specific ransomware attack?

The term is 'steganography'. It was used in the 2017 Bad Rabbit ransomware attack where image files contained hidden malicious code that infected systems once opened.

How can file-based threats lead to malware infection?

File-based threats involve malware embedded in documents or software files. Users can unwittingly install malware on their systems by downloading or opening these files.

What was the method used in the NotPetya attack to exploit file-based threats?

The NotPetya attack exploited file-based threats through a compromised software update.

What is 'vishing' and how was it used in the IRS scam calls?

Vishing is the act of using voice calls to impersonate legitimate entities to extract personal information or financial details. It was used in various IRS scam calls where attackers impersonated the Internal Revenue Service.

Why are removable devices like USB drives considered common carriers of malware?

Removable devices like USB drives are common carriers of malware because they can be easily infected and used to spread malware to other systems, as seen in the Stuxnet worm that targeted Iranian nuclear facilities.

What security risks are posed by using unsupported systems and applications?

Using unsupported systems and applications poses significant security risks because they no longer receive security updates, making them vulnerable to exploitation, as heavily exploited in the WannaCry ransomware attack.

What types of networks are susceptible to eavesdropping or man-in-the-middle attacks?

Unsecure networks, including wireless, wired, and Bluetooth networks, are susceptible to various attacks like eavesdropping or man-in-the-middle attacks.

Why are public Wi-Fi networks particularly common targets for cyber attackers?

Public Wi-Fi networks are common targets for cyber attackers because they often have weak security measures, making it easier for attackers to intercept data or perform man-in-the-middle attacks.

What is the significance of open service ports in terms of cyber security?

Open service ports can act as entry points for attackers, allowing unauthorized access or data breaches. Regular port scanning and closing unnecessary ports are essential security practices.

What was the Miri botnet attack, and how did it exploit default credentials?

The Miri botnet attack exploited IoT devices that were using default usernames and passwords, making them easy targets for attackers to gain control and create a botnet.

What is a supply chain threat, and can you provide an example of such an attack?

A supply chain threat arises when attackers target less secure elements in a supply network. The SolarWinds attack is a prime example where malware was introduced into the software supply chain, affecting thousands of its users.

Why are regular assessments and proactive security measures important for an organization's cybersecurity posture?

Regular assessments and proactive security measures are key to identifying and mitigating common threat vectors and attack surfaces, thereby strengthening an organization's cybersecurity posture and safeguarding against threats.