Threat vectors and attack surfaces

Understanding threat vectors and attack surfaces is about mapping how an attacker can access a network.

• Threat Vector: The path or route an attacker uses to gain access to a system (e.g., an email link).
• Attack Surface: The sum total of all vulnerabilities and entry points across an entire environment that are exposed to an attacker (e.g., all open ports, unpatched software, and employees combined).

Let’s break down this objective by grouping these entry points into logical categories.

1. Communication & Content Vectors

Attackers frequently use standard data formats, messages, or files to slip malicious code past defenses or trick users into executing payloads.

• Message-Based:
  • Email: The number one entry vector for corporate breaches. It relies on attachments or embedded malicious links.
  • SMS (Short Message Service): Using text messages to deliver malicious links or fraud.
  • Instant Messaging (IM): Exploiting collaboration tools like Microsoft Teams, Slack, or Discord to distribute malware or steal session tokens.
• Image-Based: Hiding malicious code in standard image files (like JPEGs or PNGs) by exploiting flaws in how an operating system or browser renders graphics, or by using steganography to hide data.
• File-Based: Dropping malicious payloads disguised as standard documents (e.g., a PDF invoice or an Excel spreadsheet containing malicious macros).
• Voice Call: Direct phone calls used to manipulate targets into giving up data (often paired with deepfakes or caller ID spoofing).
• Removable Device: Physical media like USB flash drives.
  • Example: An attacker drops a malware-laden USB drive labeled “Executive Salaries” in a company parking lot, counting on a curious employee to plug it into an internal workstation.

2. Infrastructure & System Vectors

These represent the digital and physical weaknesses left exposed inside your hardware and software setups.

• Vulnerable Software: Software containing bugs or flaws that haven’t been patched.
  • Client-Based vs. Agentless: Client-based architectures require software (an agent) installed on the endpoint to function/monitor. If the agent fails, stops running, or is vulnerable, it creates a hole. Agentless tracking relies on central network protocols (like SSH or WMI) to check systems remotely. If those central credentials or protocols are compromised, the entire infrastructure is exposed.
• Unsupported Systems and Applications (Legacy/End-of-Life): Systems that have passed their End-of-Life (EOL) date and no longer receive vendor security patches (e.g., running Windows 7 or an older version of Python). They are a goldmine for attackers.
• Unsecure Networks:
  • Wireless: Poorly configured Wi-Fi networks (such as using obsolete WEP/WPA encryption or open guest networks that provide access to internal corporate segments).
  • Wired: Unsecured physical Ethernet ports in public hallways or waiting rooms that allow anyone to plug in a laptop and directly join the internal network.
  • Bluetooth: Exploiting short-range wireless vulnerabilities to steal data (Bluesnarfing) or send unsolicited spam messages (Bluejacking).
• Open Service Ports: Network ports left open to the public internet that shouldn’t be.
  • Example: Leaving Port 3389 (Remote Desktop Protocol – RDP) or Port 22 (SSH) open to the entire world, allowing attackers to continuously brute-force local administrative credentials.
• Default Credentials: Factory settings left unchanged on devices (e.g., deploying a new network camera or router and leaving the login as admin / password). Attackers scan the internet specifically looking for these.

3. Supply Chain Vectors

Modern organizations rely on third-party ecosystems. Attackers target weaker vendors as a stepping stone into highly secured target organizations.

• Managed Service Providers (MSPs): Outsourced IT firms that manage a company’s network. Because MSPs have direct, privileged backend access to dozens of corporate client networks simultaneously, compromising one MSP allows an attacker to automatically compromise all of their clients.
• Vendors & Suppliers: Third-party companies that provide goods or services.
  • Example: The famous Target breach occurred because hackers stole network credentials from Target’s outsourced HVAC (heating and air conditioning) vendor, using that minor access to pivot into the main payment system network.

4. Human Vectors & Social Engineering

Instead of hacking code, attackers exploit human psychology (trust, fear, urgency, or curiosity) to bypass technical security controls entirely.

• Phishing: Mass, generic malicious emails sent to thousands of users, designed to trick them into clicking a malicious link or entering credentials.
• Vishing (Voice Phishing): Social engineering conducted over the phone. (e.g., an attacker calling an employee pretending to be the Help Desk, demanding their password to “fix an urgent account lock”).
• Smishing (SMS Phishing): Phishing attacks conducted via text messages (e.g., Fake package delivery notifications with tracking links that steal bank login credentials).
• Misinformation / Disinformation:
  • Misinformation: The accidental spread of false information.
  • Disinformation: The deliberate creation and distribution of false information intended to deceive, sow chaos, or damage a brand’s reputation.
• Impersonation: Pretending to be someone else, typically a person in authority (such as an executive, IT auditor, or police officer), to coerce an employee into violating security protocols.
• Business Email Compromise (BEC): A highly targeted attack in which an attacker compromises a senior executive’s real corporate email account (or perfectly spoofs it) and emails the finance department, instructing them to urgently wire funds to a fraudulent vendor account.
• Pretexting: Creating a complex, fabricated scenario (the “pretext”) to establish trust and manipulate a target. The attacker does extensive research beforehand so they sound completely legitimate.
• Watering Hole: A passive attack in which a hacker infects a specific, trusted website frequently visited by the target group.
  • Example: An attacker wants to hack local system administrators, so they find a popular local IT discussion forum, compromise that forum site, and plant malware on it. When the local admins visit the site, their computers get infected.
• Brand Impersonation: Creating fake websites, logos, or profiles that closely resemble a trusted corporation (such as Microsoft, Amazon, or a bank) to steal customer credentials.
• Typosquatting (URL Hijacking): Registering domain names that are common misspellings of popular websites.
  • Example: Registering microsft.com or packetflipper.cm and hosting a malicious copycat site there, waiting for users to make a typing error in their browser.