CH3: Threat Vectors and Attack Surfaces

Introduction

An attack vector is a path or method that an attacker uses to gain initial access to a system or network. Understanding attack vectors is essential because defensive strategy must address how threats actually enter the organization, not just what happens once they're inside.

The modern threat landscape encompasses diverse vectors spanning communication channels, visual media, remote access mechanisms, endpoints, supply chains, and human psychology. Organizations often excel at defending against one vector while neglecting another equally dangerous path. This chapter examines the most prevalent attack vectors, their underlying mechanisms, and how they interact with organizational vulnerabilities.

An oval labeled Attack Surface encloses an employee at the center connected by dashed lines to a cloud service, a web server, a workstation, a database, a Wi-Fi router, and a smartphone. Outside the oval, three labeled attack vectors point inward with arrows: phishing email, exposed RDP, and poisoned update. — **Figure 3.1.** Attack vectors and the attack surface. The attack surface is the total set of assets and entry points exposed to attack; a vector is the specific path an attacker takes to reach one of them.

By the end of this chapter, you will understand how attackers exploit communication channels, media, network access, and human behavior. You will recognize attack surfaces in your environment and develop strategies to reduce exposure across multiple vectors simultaneously.

Learning Objectives

After completing this chapter, you will be able to:

Identify message-based attack vectors including phishing, Business Email Compromise (BEC), smishing, and attacks leveraging collaboration tools.
Analyze image, attachment, and browser-based vectors, including malicious QR codes, macro exploits, and JavaScript injection.
Explain network-based and remote access vectors including compromised infrastructure, RDP attacks, and credential-based threats.
Assess endpoint, supply chain, and physical vectors that expand attack surfaces beyond traditional network boundaries.
Categorize vulnerabilities that enable attack vectors and prioritize mitigation based on organizational risk profile.

3.1 Message-Based Vectors

Email as an Attack Vector

Email remains the dominant attack vector because it combines scale, trust, and technical accessibility. Organizations receive millions of emails daily, making manual inspection infeasible. Additionally, email has deep historical integration into business processes, making users reluctant to question its trustworthiness.

Phishing

Phishing is a broad category of social engineering attacks delivered via email. Phishing attempts to trick users into clicking malicious links, opening infected attachments, or divulging credentials.

Spear-phishing targets specific individuals or organizations rather than using mass distribution. Spear-phishing emails often reference legitimate business processes, use the target's real name, or reference recent company events. This personalization increases click-through rates because the email appears legitimate.

Whaling is spear-phishing that targets high-value individuals such as executives, board members, or senior managers. Whaling emails often impersonate authority figures or external business partners and request urgent action (wire transfers, credential changes, confidential information access).

Figure 3.3. The targeting ladder. As an attacker moves from mass phishing to spear-phishing to whaling, the number of targets falls, the research invested per target rises, and the potential impact of a single success increases.

Vishing and smishing extend phishing beyond email:

Vishing (voice phishing): Attackers call targets, impersonate IT support or other authority figures, and request credentials or system access.
Smishing (SMS phishing): Attacks delivered via text message, often directing users to malicious links or fake login pages.

Business Email Compromise (BEC)

Business Email Compromise attacks exploit the organizational communication patterns and trust relationships. BEC attacks typically unfold as follows:

The attacker researches the target organization, identifying key business relationships, financial processes, and personnel.
The attacker registers a domain name similar to a known business partner (e.g., acmecorp-us.com instead of acmecorp.com) or compromises a legitimate email account.
The attacker sends an email that appears to come from the business partner or internal executive, requesting an urgent financial transaction or credential change.
Lacking mechanisms to verify the request independently, the recipient complies.
Funds are transferred to attacker-controlled accounts, or credentials are changed, locking out the legitimate owner.

BEC attacks often bypass email filtering because they do not contain malware or malicious links. The attack relies entirely on social engineering and exploits the trust and urgency embedded in business email.

Five connected stages of a business email compromise. One, Research: the attacker maps people and payment workflows. Two, Position: the attacker registers a lookalike domain or takes over a real inbox. Three, Request: a message appearing to come from an executive asks finance to wire 250,000 dollars urgently. Four, Comply: the victim approves the transfer with verification and callback steps ignored. Five, Cash Out: funds move to an attacker or mule account and the legitimate account is locked out. A banner across the bottom reads: break the chain, verify through a known channel. — **Figure 3.4.** Anatomy of a BEC attack. No malware or malicious link is required at any stage, which is why BEC routinely defeats content-based email filtering and must be countered with out-of-band verification of payment changes.

Message-Based Attacks in Collaboration Tools

Modern organizations use collaboration platforms such as Slack, Microsoft Teams, Discord, and Zoom. These platforms present attack vectors similar to email:

Direct message phishing: Attackers create accounts impersonating colleagues or external partners and send direct messages with malicious links.
Channel hijacking: Attackers compromise user accounts and post malicious links in high-visibility channels.
Meeting injection: Attackers join legitimate meetings uninvited or register with names similar to actual participants, creating confusion and opportunities for social engineering.

Warning

Collaboration tools often have weaker authentication than email systems. Multi-factor authentication (MFA) adoption lags, and users may be less vigilant about messages received through chat platforms than email.

3.2 Image, Attachment, and Browser-Based Vectors

Malicious Attachments

Email attachments present multiple vectors:

Office Macros

Macros are scripts embedded in Microsoft Office documents (Word, Excel, PowerPoint). Macros can perform arbitrary actions: downloading malware, executing PowerShell commands, or modifying system files.

When a user opens a document containing macros, Office prompts the user to enable macros. Attackers craft emails with pretexts such as "You must enable macros to view this document" or "This file requires macros for proper rendering." Users frequently enable macros because the request appears routine or legitimate.

Two panels. Panel one, the phishing email, shows a message from a lookalike payroll domain with an urgent subject line, an instruction to select Enable Content, and a macro-enabled .docm attachment; callouts mark the lookalike domain, the urgency cue, the enable-content request, and the macro-enabled file type. Panel two, the hidden macro, shows a simplified non-functional code listing that gathers system information, contacts an attacker server, downloads a payload, and runs it in the background, followed by a four-step sequence: document opened, macro triggered, payload requested, system compromised. A footer reads: defense, block internet macros, verify the sender, report the message. — **Figure 3.5.** Malicious Office macro delivery. The attachment is inert until the user selects Enable Content, which makes the user action, not the file itself, the decisive step in the attack.

PDF and RTF Exploitation

Portable Document Format (PDF) readers contain complex code to render documents. Vulnerabilities in PDF readers (especially older versions) allow attackers to embed exploits that execute when the document opens, bypassing user interaction requirements.

Rich Text Format (RTF) documents similarly contain vulnerabilities that allow code execution. RTF exploits are often more reliable than PDF exploits because RTF parsing is simpler and vulnerabilities are less frequently patched.

Compressed Archives

Attackers distribute malware inside compressed archive files (ZIP, RAR, 7Z) to evade email scanning. Archives may be password-protected, requiring the user to enter a password provided in the accompanying email. This requirement bypasses automated extraction by email filters.

Malicious QR Codes

QR codes (Quick Response codes) encode URLs or other data in visual format. A QR code on a phishing email or website may direct users to a fake login page, malware download, or credential harvesting site.

QR codes are difficult for users to validate because the encoded content is not visible without scanning. Unlike URLs, which display the destination domain, QR codes appear as generic matrices. Users cannot easily predict where a QR code will direct them.

Browser-Based Vectors

Malicious Browser Extensions

Browser extensions are small programs installed in web browsers to add functionality. Attackers distribute malicious extensions through official extension stores (Chrome Web Store, Firefox Add-ons) using deceptive names or by compromising legitimate extensions.

Malicious extensions intercept traffic, modify web pages, steal credentials, inject advertisements, or exfiltrate browsing history. Extensions operate with broad permissions to web content, making them powerful attack vectors.

Drive-By Downloads and Malvertising

A drive-by download occurs when a user visits a website and malware is downloaded and executed without the user's knowledge or consent. Modern browsers have reduced the severity of drive-by downloads through automatic updates and sandboxing, but vulnerabilities still exist.

Malvertising is a variant where attackers place malicious advertisements in legitimate advertising networks. These advertisements direct users to malware distribution sites or redirect to exploit kits that target browser vulnerabilities.

Five numbered stages left to right. One, visit: a user loads a legitimate-looking website. Two, malicious ad: an advertisement on the page carries hidden malicious content. Three, redirect: the browser is sent to an attacker-controlled site. Four, silent download: a broken shield and a progress bar show a payload downloading without a prompt. Five, system compromised: a locked screen with a warning symbol. A caption reads that a website visit or malicious ad redirect can trigger exploitation and malware delivery. — **Figure 3.6.** Drive-by download and malvertising. The user takes no action beyond loading a page, so the defense is browser and plug-in patching plus ad and script filtering rather than user awareness.

Cookies store session tokens and authentication credentials. If an attacker can steal cookies, they can hijack authenticated sessions without knowing the victim's password.

Session theft occurs through:

Man-in-the-middle attacks: Intercepting unencrypted traffic and reading cookies sent to servers.
Cross-site scripting: Malicious JavaScript exfiltrating cookies from the browser.
Local file access: Malware accessing the browser's local storage where cookies are cached.

Five numbered stages. One, injection: an attacker submits a script through a comment field. Two, page load: a victim visits the page. Three, script runs: the injected script executes in the trusted site context, reading the session cookie and sending the token to the attacker. Four, cookie stolen: the token is exfiltrated, with a note that the cookie is readable when the HttpOnly flag is absent. Five, session hijacked: the attacker is authenticated with a note that the password was not required. A footer reads: defense, output encoding, Content Security Policy, HttpOnly cookies. — **Figure 3.7.** From cross-site scripting to session hijacking. Stealing a valid session token lets an attacker act as the user without ever learning the password, which is why session theft defeats password strength requirements.

JavaScript Injection and Cross-Site Scripting (XSS)

Cross-Site Scripting vulnerabilities in web applications allow attackers to inject malicious JavaScript that executes in the victim's browser in the context of the vulnerable website.

For example, if a website's search function does not properly sanitize input, an attacker could craft a search URL containing JavaScript code: https://site.com/search?q=<script>stealCookies()</script>. When another user visits this URL, the JavaScript executes in their browser, potentially stealing their session cookies.

Four numbered stages. One, crafted link: the attacker sends a link to a single victim. Two, victim clicks: the malicious input travels in the request. Three, echoed in response: the server reflects the untrusted input back inside the page. Four, script runs: the response reaches the same victim and the script executes. A footer reads: one request, one victim, not stored. — **Figure 3.8.** Reflected cross-site scripting. The malicious input is never saved on the server, so the attack requires the victim to follow an attacker-supplied link and affects only that one request.

Figure 3.9. Stored cross-site scripting. Because the payload is saved server-side and served to everyone who views the page, a single injection reaches every subsequent visitor without any further attacker action.

3.3 Network-Based and Remote Access Vectors

Compromised Infrastructure

Organizations often trust third-party services, ISPs, DNS providers, and CDNs (Content Delivery Networks). If these providers are compromised, traffic flowing through them becomes vulnerable.

DNS hijacking redirects domain names to attacker-controlled servers. Users intending to visit legitimate websites are redirected to phishing pages or malware distribution sites. DNS hijacking can occur through:

Compromised DNS servers: Attackers modify DNS records at authoritative servers.
Compromised routers: Home or office routers are reconfigured to redirect DNS queries to attacker-controlled servers.
ISP-level manipulation: Compromised ISP infrastructure redirects traffic for entire regions.

Five numbered stages around a DNS resolver. One, DNS query: a victim requests the domain portal.example. Two, forged reply: the attacker races the real response from the authoritative DNS server. Three, cache poisoned: the resolver stores a false IP address. Four, poisoned answer: the resolver returns the attacker's IP to clients. Five, redirected: the victim reaches a fake website that presents a login form. A note reads that the URL can still look correct. A footer reads: defense, DNSSEC validation, patched resolvers, cache monitoring. — **Figure 3.10.** DNS cache poisoning. The victim types the correct domain name and sees the correct address bar, which is why this attack cannot be detected by inspecting the URL alone.

Remote Access Protocols

Organizations grant remote access to employees, contractors, and support personnel using protocols such as RDP (Remote Desktop Protocol), VNC (Virtual Network Computing), and VPN (Virtual Private Network).

Remote Desktop Protocol (RDP)

RDP enables graphical remote desktop access to Windows systems. RDP is convenient but creates significant attack surface:

Default credentials: Many administrators deploy systems with default or shared passwords.
Weak credentials: Attackers use credential spraying and brute-force attacks against RDP services exposed to the Internet.
Protocol vulnerabilities: Older RDP versions contain remote code execution vulnerabilities.
Credential harvesting: Attackers capture credentials used to authenticate to RDP, then use those same credentials for lateral movement.

Four numbered stages showing intended RDP use. One, IT admin: an administrator connects from a remote location. Two, secure entry: access passes through a gateway labeled VPN plus MFA or RD Gateway, drawn as a fortified wall. Three, RDP session: the Remote Desktop Protocol carries screen, keyboard, and mouse. Four, remote Windows system: an internal computer or server. A callout notes that RDP grants full graphical access to a remote computer. A footer reads: preferred, VPN or RD Gateway, MFA, limited network access. — **Figure 3.11.** Remote Desktop Protocol as intended. RDP itself is a legitimate administrative tool; the risk comes from exposing it directly to the internet rather than placing it behind a gateway with multi-factor authentication.

VPN and Remote Access Compromises

VPN concentrators aggregate remote access and authenticate users. Compromised VPN credentials grant direct access to internal networks. VPN infrastructure may lack multi-factor authentication (MFA), making credential theft sufficient for full network access.

3.4 Endpoint, Supply Chain, and Physical Vectors

Mobile Devices

Mobile devices (smartphones, tablets) are endpoints with access to email, messaging, and corporate applications. Mobile attack vectors include:

Malicious mobile applications: Apps distributed through official stores or sideloaded from third-party sources that steal data or provide system access.
Mobile device compromise: Exploiting OS vulnerabilities to gain system-level access and monitor all user activity.
SIM swapping: Attackers convince mobile carriers to transfer phone numbers to attacker-controlled devices, intercepting SMS-based authentication codes.

Five numbered stages. One, impersonate: the attacker poses as the victim to a mobile carrier representative. Two, transfer number: the carrier moves the phone number from the legitimate SIM or eSIM to the attacker's. Three, victim loses service: the victim's phone shows no service and calls and texts stop. Four, codes go to attacker: an SMS security code is delivered to the attacker's device instead of the victim's. Five, account takeover: the attacker enters the code, resets passwords, and accesses accounts. A banner reads that the phone number moves, not the physical phone. A footer reads: defense, carrier account PIN, number lock, authenticator app or security key. — **Figure 3.12.** SIM swapping. Because the phone number itself is transferred, SMS-delivered one-time codes arrive at the attacker's device, which is the core reason SMS is the weakest common second factor.

Supply Chain Compromises

Organizations depend on software, hardware, and services from external vendors. Compromising a vendor may provide access to all customers using that vendor's products.

Software supply chain attacks include:

Malicious code injection: Attackers compromise a software vendor's build system and inject malware into legitimate releases.
Dependency vulnerabilities: Open-source libraries used by many organizations contain vulnerabilities exploited to compromise all downstream consumers.
Trojanized legitimate tools: Attackers distribute modified versions of legitimate tools (npm packages, Docker images, development tools) through package repositories.

Five numbered stages titled one vendor, many victims. One, build system compromised: an attacker gains access to the SolarWinds build environment. Two, SUNBURST inserted: malicious code is placed inside the Orion product. Three, update signed and distributed: the trojanized update receives a valid digital signature and moves through the trusted update channel. Four, customers install update: government and corporate buildings receive roughly 18,000 installations. Five, selected networks accessed: the attacker performs follow-on intrusion into a small number of high-value agencies, major corporations, and sensitive systems. A footer reads: trusted update, valid signature, malicious code inside. — **Figure 3.13.** The SolarWinds Orion supply chain compromise, disclosed in December 2020. The malicious update carried a valid vendor signature, so signature verification, the control normally relied on to prove software integrity, returned a passing result.

Hardware supply chain attacks include:

Firmware modifications: Attacker-installed firmware provides persistence even after OS reinstalls.
Physical device tampering: Attackers modify hardware components or insert additional components (monitoring devices, hardware keyloggers) before devices reach customers.

USB and Removable Media

USB attacks exploit the trust users place in removable media:

USB drop attacks: Attackers leave USB devices in parking lots or public spaces. Users who find the devices insert them into computers, executing malware.
Malicious USB devices: Purpose-built devices that emulate keyboards or network adapters, executing commands or capturing traffic.

Five numbered stages. One, prepare the bait: an attacker loads a USB device with a malicious file or programs it to act as an input device, and labels it Confidential. Two, drop it: the device is left in a parking lot, lobby, or break room. Three, employee finds it: curiosity creates the opening. Four, USB connected: the bait file is opened or the device triggers automatically. Five, system compromised: malware runs and the attacker gains access. A callout reads that curiosity bypasses the network perimeter. A footer reads: defense, do not connect unknown USB devices, turn them in to IT. — **Figure 3.14.** The USB drop attack. The device is carried through the front door by an employee, so every network perimeter control is bypassed before the attack begins.

Internet of Things (IoT) and Operational Technology (OT)

IoT devices such as smart building controls, industrial sensors, and networked cameras frequently lack security updates and run outdated firmware. Compromised IoT devices may serve as entry points to networks or platforms for distributed attacks.

Operational Technology systems control physical infrastructure: power grids, manufacturing equipment, water treatment facilities. OT systems often prioritize reliability over security and may run unpatched systems for decades. Compromised OT systems can cause physical harm (equipment damage, power outages, product safety hazards).

Wireless Vectors

Bluetooth and NFC

Bluetooth is a short-range wireless protocol used for headsets, mice, keyboards, and mobile devices. Bluetooth vulnerabilities allow attackers to:

Intercept communications: Eavesdrop on unencrypted Bluetooth data.
Inject commands: Send malicious commands to Bluetooth devices.
Blue jacking: Send unsolicited messages to Bluetooth-enabled devices.

Near-Field Communication (NFC) is a contactless protocol used in payment cards, access badges, and public transportation tickets. Attackers can read or modify NFC data from a distance of a few centimeters, enabling payment fraud or credential forgery.

Wi-Fi Attacks

Rogue access points broadcast Wi-Fi networks with names identical to legitimate networks. Users automatically connect to the rogue network, allowing attackers to intercept all traffic, insert malicious content, or harvest credentials.

WPA2/WPA3 vulnerabilities: Even encrypted Wi-Fi networks contain vulnerabilities. The KRACK attack, disclosed in 2017, allowed decryption of WPA2 traffic. Newer WPA3 protocol addresses some issues but deployment remains incomplete.

Physical Security and Tailgating

Tailgating (also called "piggybacking") occurs when an unauthorized person follows an authorized employee through a secured door without using a badge. An attacker gains physical access to a facility, enabling theft, sabotage, or planting of malicious devices.

Shoulder surfing is observation of a user entering credentials, PINs, or sensitive information. Attackers may stand nearby and watch a user unlock a computer or enter a password.

Two panels. The upper panel shows an access control vestibule: a person badges through Door 1 into an enclosed space while a second person is blocked outside and marked tailgater blocked; Door 2 into the secure interior opens only after Door 1 closes, enforcing one person at a time. The lower panel shows shoulder surfing: a person standing behind a seated user watches them enter a PIN on a laptop, with a warning that credentials are captured by watching. Icons below read: privacy filter, shield the keypad, stay aware. — **Figure 3.15.** Physical controls against tailgating and shoulder surfing. An access control vestibule enforces one authenticated entry at a time, converting a social problem, refusing to hold the door, into a mechanical one.

Human-Based Vectors

Social engineering exploits human psychology rather than technical vulnerabilities. Effective social engineering techniques include:

Pretexting: Creating a false scenario to build trust and extract information (e.g., "I'm from IT, resetting your password").
Authority impersonation: Posing as a legitimate authority figure (manager, law enforcement, security personnel) to compel compliance.
Urgency and scarcity: Creating pressure to bypass normal caution (e.g., "Your account will be closed if you don't verify immediately").
Reciprocity: Performing a favor to create obligation (e.g., "I helped you before, now please help me access the system").

Social engineering is highly effective because humans are inherently trusting and vulnerable to manipulation. Technical controls alone cannot eliminate human-based attack vectors.

Analyst Perspective

The most successful attacks often combine multiple vectors. A phishing email (message vector) contains a malicious attachment (attachment vector) targeting a user who works remotely (remote access vector). Defending against one vector while neglecting others leaves critical gaps.

3.5 Vulnerability Types and Attack Surfaces

System Vulnerabilities

System vulnerabilities are weaknesses in operating systems, server software, and system services:

Unpatched software: Running outdated versions with known exploitable vulnerabilities.
Weak authentication: Default credentials, easily guessable passwords, or lack of multi-factor authentication.
Insecure configurations: Systems deployed with unnecessary services enabled, open shares, or overly permissive access controls.

Three stacked panels. Unpatched software: a system running version 2.1 with update 4.8 available, a cracked shield, and the note known flaw still present. Weak authentication: a login form with the username admin and the password admin123, an open padlock, and a shield showing MFA disabled, with the note guessable password and no MFA. Insecure configuration: a cloud server with public access toggled on, an unlocked folder share, and an open door in a wall, with the note open share and excessive access. — **Figure 3.16.** The three recurring system vulnerability categories. Each represents a defect in operations rather than in code, which means each is remediated through process discipline rather than a vendor patch alone.

Application Vulnerabilities

Application vulnerabilities include:

Input Validation Flaws

Injection vulnerabilities occur when applications fail to validate or sanitize user input. Common injection types include:

SQL injection: Attackers insert SQL commands into input fields, allowing unauthorized database queries or modifications.
Command injection: Attackers inject shell commands through application input, achieving remote code execution.
LDAP injection: Attackers manipulate LDAP queries to modify directory access controls or extract sensitive information.

Four numbered stages. One, crafted input: an attacker submits unexpected text into a login form. Two, unsafe query built: the application concatenates the input into a SQL statement. Three, database executes it: the input is treated as instructions rather than data. Four, unauthorized result: login is bypassed and data is exposed or changed. A banner reads that the database cannot distinguish code from unsafe input. A comparison strip contrasts unsafe, query plus user input, with safe, query plus parameter. A footer reads: defense, parameterized queries, input validation, least-privilege database accounts. — **Figure 3.17.** How SQL injection works. The database faithfully executes what it receives; the defect is in the application's construction of the query, which is why parameterized queries rather than input filtering are the primary fix.

Four numbered panels explaining an always-true condition. One, expected login: a form sends a username and password, and the expected query finds a user where the name matches and the password matches. Two, untrusted input: an attacker enters a value in the password field that closes the string and appends OR '1' = '1', a condition that is always true. Three, query logic changes: the application combines the expected password-matches condition with the always-true condition using OR, so the overall result is true. Four, possible impact: login bypass, too many rows returned, and sensitive data exposed, with a note that database changes are possible only when the application permits write operations and its database account has excessive privileges. A comparison strip contrasts unsafe command plus raw input, where input is treated as part of the command, with safe parameterized query, where input remains data. A footer reads: defense, parameterized queries, input validation, least-privilege database accounts. — **Figure 3.18.** Why an always-true condition subverts a query. Breaking the injected string down to its logical parts shows that the attacker is not guessing a password but changing the question the database is asked.

Authentication and Access Control

Broken authentication allows attackers to compromise user accounts or bypass login mechanisms.

Broken access control allows users to access resources or perform actions outside their authorization, such as viewing other users' data or performing administrative functions without proper permissions.

Insecure Deserialization

Applications sometimes serialize objects (convert them to byte streams) for storage or transmission. If an application deserializes untrusted data without validation, attackers can inject malicious objects that execute code during deserialization.

Cross-Site Request Forgery (CSRF)

CSRF exploits the trust a website places in a user's browser. If a user is authenticated to a website and subsequently visits an attacker-controlled page, the attacker can craft requests that the browser executes in the context of the authenticated session, potentially transferring funds or changing account settings.

Five numbered stages. One, victim signs in: a valid session cookie is stored for a trusted site. Two, attacker sets the trap: a malicious page, link, or message contains a hidden request to the trusted site. Three, victim visits: the trap loads in the same browser. Four, forged request sent: the browser automatically attaches the session cookie. Five, action executed: the trusted site sees a valid session and changes the account email. Callouts note that CSRF abuses the victim's existing session and that the attacker does not need to know the password or steal the cookie. A comparison strip reads: XSS runs attacker script in the trusted page, CSRF tricks the browser into sending a trusted request. A footer reads: defense, anti-CSRF tokens, SameSite cookies, origin checks, reauthentication. — **Figure 3.19.** How a CSRF attack works. The attacker never reads the session cookie; the browser attaches it automatically, so the server receives a request that is authentic in every respect except intent.

Credential Vulnerabilities

Credential-based attacks target authentication mechanisms:

Credential stuffing: Attackers obtain credential lists from previous breaches and attempt to reuse credentials against other services.
Password spraying: Attackers systematically try common passwords (qwerty, Password123, etc.) against many accounts.
Brute-force attacks: Attackers systematically try all possible password combinations until finding a match.
Credential replay: Attackers intercept credentials transmitted over unencrypted channels and replay them to authenticate without knowing the password.

Misconfiguration

Misconfiguration vulnerabilities arise from deployment and operational choices rather than software flaws:

Cloud storage buckets exposed to public read or write access through misconfigured permissions.
Development credentials committed to version control repositories, exposing API keys and passwords.
Debug endpoints left enabled in production environments.
Open ports allowing unauthorized services to be discovered and exploited.

Emerging Vulnerabilities: AI and LLMs

Large Language Model (LLM) attacks exploit the training and operational characteristics of AI systems:

Prompt injection: Attackers craft inputs that manipulate LLM behavior, extracting training data, bypassing safety guardrails, or generating malicious content.
Data poisoning: Attackers inject malicious data into training datasets, causing models to learn harmful patterns.
Model extraction: Attackers query models repeatedly to reverse-engineer proprietary models.

Emerging Vulnerabilities: Identity Providers

Identity providers (single sign-on systems, directory services) are high-value targets because compromising the identity provider provides access to all services that trust it:

Federation vulnerabilities: Attackers exploit trust relationships between identity providers to access federated services.
Token forgery: Attackers create forged authentication tokens, impersonating legitimate users.
Credential storage vulnerabilities: Identity provider databases are attractive targets because they often contain plaintext or poorly encrypted credentials.

Putting It Together: Layered Defense Against Multiple Vectors

A financial services organization assesses its attack surface:

Identified Vectors: 1. Email phishing and BEC attacks. 2. RDP compromise and lateral movement. 3. Compromised software dependencies in custom applications. 4. Malicious USB device insertion by physical intruders.

Layered Defense Strategy:

Email vector: Deploy email filtering with sandboxing for attachment detonation. Require MFA for all email-based authentication. Implement DMARC/SPF/DKIM to prevent domain spoofing. Train users to identify phishing indicators.
RDP vector: Disable RDP on the Internet (use VPN for remote access instead). Require MFA for all remote access. Implement network segmentation to limit lateral movement if RDP is compromised. Monitor RDP connections for suspicious patterns.
Supply chain vector: Implement SBOM (Software Bill of Materials) scanning to identify vulnerable dependencies. Use automated dependency update tools. Require security assessments from critical vendors.
Physical vector: Implement badge access controls with logging. Provide USB ports in locked cabinets. Deploy device-control software to restrict USB peripheral access.

This multi-vector approach acknowledges that no single control is sufficient; instead, layered defenses address the most likely and highest-impact vectors.

Chapter Summary

Message-based vectors (email, collaboration tools) exploit trust and scale. Phishing, spear-phishing, BEC, vishing, and smishing use social engineering to trick users into clicking malicious links, opening infected attachments, or divulging credentials.
Attachment-based attacks leverage macro-enabled Office documents, PDF/RTF vulnerabilities, and compressed archives that evade scanning. Malicious QR codes provide a user-friendly method to direct targets to phishing pages or malware.
Browser-based vectors include malicious extensions, drive-by downloads, malvertising, cookie theft, session hijacking, and JavaScript injection. Modern browser security has reduced but not eliminated these risks.
Remote access protocols (RDP, VPN) present significant attack surface when exposed to the Internet or protected with weak authentication. Compromised remote access credentials grant direct internal network access.
Supply chain vulnerabilities span software dependencies, hardware modifications, and vendor compromises. A single compromised vendor may affect hundreds of downstream organizations.
Endpoint, IoT, and OT devices expand attack surfaces beyond traditional IT systems. Mobile devices, smart buildings, industrial equipment, and legacy systems often run unpatched firmware with weak authentication.
Wireless protocols (Bluetooth, NFC, Wi-Fi) enable attacks from distance with minimal user interaction. Rogue access points and protocol vulnerabilities remain common.
Physical security vectors including tailgating, shoulder surfing, and USB attacks demonstrate that technical controls alone are insufficient. Human factors and physical access must be addressed.
Emerging vulnerabilities in AI systems (prompt injection, data poisoning), identity providers (federation attacks, token forgery), and cloud infrastructure (misconfiguration) represent rapidly evolving threats.
Effective defense requires a layered approach addressing multiple vectors simultaneously. No single control is sufficient; organizations must understand their attack surface and prioritize based on likelihood, impact, and organizational risk profile.