Threats, Vulnerabilities & Attacks

A threat domain is an area of control, authority or protection that an attacker can exploit to reach a system. Attackers have eight routes into a domain.

Physical

Direct access to systems and networks.

Wireless

Signal that reaches beyond the building.

Bluetooth / NFC

Short-range devices.

Email

Malicious attachments.

Supply chain

The least secure link in the chain.

Social media

Accounts used as an entry point.

Removable media

Flash drives.

Cloud

Cloud applications.

Threats fall into eight categories. Sorting threats this way lets you judge likelihood and monetary impact, so security effort can be prioritised.

Internal threats come from current and former staff, contractors and partners mishandling data, accidentally or deliberately (infected media, malicious mail). External threats come from amateur or skilled outsiders who exploit device vulnerabilities or use social engineering.

Internal threats are usually worse because insiders already have the access and the knowledge:

• —Direct access to premises and infrastructure devices.
• —They know the network, its resources and its confidential data.
• —They know the countermeasures in place.

Each part of an organisation has its own typical threats. The user is the weakest link: no control makes a system more secure than the behaviour of the people using it.

A private cloud is one organisation's own resources. A public cloud is provider services shared across organisations, in three models: SaaS, PaaS and IaaS. SaaS is subscription software hosted centrally and reached by browser or app, not stored locally. In the public cloud the provider secures the cloud; you secure your own resources on it.

APT

Advanced persistent threat: a continuous, well-funded attack that stays undetected for a long time. It uses elaborate espionage tactics, multiple actors and sophisticated malware, and targets governments and high-level organisations.

Algorithm attack

Abuses algorithms in legitimate software to force unintended behaviour. Energy-reporting data can pick targets or trigger false alerts; a machine can be disabled by exhausting RAM or overworking the CPU.

Backdoor

Bypasses authentication. Examples: Netbus and Back Orifice.

RAT

Remote administrative tool: how a backdoor gets installed when the user unknowingly runs it. It gives the criminal administrative control and survives the original vulnerability being patched.

Rootkit

Modifies the OS to create a backdoor, then hides by altering forensics and monitoring tools. It uses privilege escalation and modifies system files, so it is very hard to detect; usually the machine must be wiped and rebuilt.

Defenders share what they learn. The CVE list (Common Vulnerabilities and Exposures) is the public dictionary of known flaws, sponsored by US-CERT and DHS and maintained by the MITRE Corporation. Each entry has an ID number, a description and references.

The dark web is encrypted content that search engines don't index; it needs special software or authorisation. Researchers monitor it for new threat intelligence. Closed source intelligence needs a paid subscription, while OSINT (open source intelligence) is publicly available; sharing is growing across government, universities, healthcare and business.

IOCs (indicators of compromise) are evidence of a breach, such as malware signatures, domain names and file hashes. AIS (Automated Indicator Sharing) shares them in real time, using the structured languages STIX and TAXII.

Social engineering is a non-technical attack on people, not on software. It manipulates people into acting or revealing information, and exploits their willingness to help, greed or vanity.

Counters: ATM screens are viewable only at certain angles to defeat shoulder surfing; shred documents or use burn bags against dumpster diving; a mantrap, where the outer door closes before the inner opens, stops tailgating. Tailgaters appear to be escorted in, join a crowd, or target someone careless about the rules.

Attackers lean on seven tactics:

Authority

People comply with perceived authority.

Intimidation

Bully the victim into acting.

Consensus

'Everyone else is doing it'.

Scarcity

Only a few left.

Urgency

Limited time to act.

Familiarity

Build rapport, or clone a friend's profile.

Trust

Slower to build, e.g. the fake security expert.

Five more deception methods:

Invoice scam

A fake invoice drives you to a fake login.

Watering hole

Infect a site the target uses often.

Typosquatting

A mistyped URL reaches the attacker's lookalike.

Prepending

Strip the 'external' tag so mail looks internal.

Influence campaigns

Coordinated fake news and disinformation.

Defence is mostly behaviour:

• —Give no credentials or confidential data to unknown parties, on any channel.
• —Resist enticing emails and links, and be wary of automatic downloads.
• —Establish and teach security policies, and make employees own security issues.
• —Don't give in to pressure.

Malware is any code that steals data, bypasses controls or harms a system. Three kinds are told apart by how they spread or hide.

A logic bomb is dormant code that fires on a trigger such as a date or a database entry. It sabotages records, erases files or attacks the OS; newer ones destroy hardware by overdriving fans, CPU, memory, drives and power supplies until they fail.

Ransomware encrypts your data and holds it hostage until you pay, via an untraceable system. Many victims never get their data back. It spreads through phishing attachments or a software vulnerability.

A DoS attack comes in two forms: an overwhelming quantity of traffic, or maliciously formatted packets the receiver can't process. Either way the result is a slowdown or crash. A DDoS is built from zombies (infected hosts) controlled by handler systems. The zombies scan and infect more hosts, and on command the whole botnet attacks at once.

Keylogging also has legitimate uses, such as parental monitoring, and anti-spyware suites detect and remove it. Defending against a zero-day needs a holistic view of the network architecture.

Defending against network attacks:

• —Firewalls drop outside packets claiming internal addresses.
• —Keep patches and upgrades current.
• —Distribute the workload across servers.
• —Block external ICMP to blunt DoS and DDoS.

Grayware is annoying or undesirable behaviour that is technically legitimate, e.g. location tracking, legitimised in the small print of the licence. SMiShing is phishing by text message, with fake texts pushing a malicious site or fraudulent number.

A rogue access point is an access point on a secure network that nobody authorised. Even a well-meaning employee's AP creates a way in, and attackers use social engineering to get the physical access to plant one. An evil twin is a lookalike hotspot with a stronger signal that watches everything you do.

RF jamming drowns the signal so it never reaches the receiver; the jammer's frequency, modulation and power must match the target. Wireless is also prone to EMI, RFI, lightning and fluorescent noise.

Bluetooth is a short-range, low-power personal area network protocol (mobiles, laptops, printers) that uses pairing. Both attacks below need the attacker within Bluetooth range.

WEP failed for two reasons: the key was shared ever more widely with no way to manage it, and the initialisation vector was too small, readable and static. WPA, then WPA2, replaced it; with WPA2 the key can't be recovered by watching traffic.

Wi-Fi and mobile defence:

• —Change default settings; enable authentication and encryption.
• —Place APs outside the firewall or in a DMZ.
• —Use WLAN tools such as NetStumbler to find rogue APs.
• —Write a guest access policy.
• —Employees use a remote-access VPN for the WLAN.

The four code injection attacks (XML, SQL, DLL, LDAP) all come from unvalidated input. A buffer overflow causes a crash, data compromise or privilege escalation, can give an attacker complete control of the device, and accounts for nearly half of all program exploits according to Carnegie Mellon.

Metasploit Framework develops and runs exploit code on remote targets. Meterpreter is its payload, loaded into a running process and run from memory, never the hard drive, so it evades antivirus. It also has a module for controlling the webcam.

The first line of defence for applications is solid code: validate everything coming from outside a function. Keep the OS and applications up to date, because not every program updates automatically.

Spam shows itself through: no subject line, a request to update account details, misspellings or strange punctuation, long or cryptic links, a legitimate look with tiny differences, and an urgent request to open an attachment.

Defending against email and browser attacks: ISPs filter most spam before it arrives; antivirus and email software remove dangerous spam; educate employees about unsolicited mail; always scan attachments, even from trusted contacts; join the APWG (Anti-Phishing Working Group); keep all software patched.

Four modern attack surfaces go beyond the browser:

Physical

Malicious USB drives, doctored cables, card skimming.

Adversarial AI

Tainted data corrupts machine-learning predictions.

Supply chain

Intercept third-party parts, software or agreements.

Cloud-based

Target data, apps and platforms hosted off-site.