Attacks and Exploits · Topic 9 of 10
Attacks on Specialized Systems
Understand attacks on mobile, operational technology and short-range wireless systems: concepts, indicators, named tools and the defences for each class.
- 4 min
- Mobile risks are insecure storage, rooting or jailbreaking, and excessive app permissions.
- MobSF, Frida, Drozer and ADB are the named mobile assessment tools.
- OT protocols such as Modbus often have no authentication or encryption.
What it is
Specialized systems are devices that are not ordinary servers or workstations: mobile phones, operational technology (OT) controllers and short-range wireless devices. They often run older protocols with little or no authentication, so they need their own attack awareness.
The exam expects you to recognise the class of system, the weakness being abused and the defence. Testing these systems usually needs extra scope approval because many are fragile or safety-critical.
How it works
Mobile systems
Mobile attacks target the handset, its apps and its stored data.
| Topic | Idea | Defence |
|---|---|---|
| Information disclosure | Sensitive data left in insecure local storage, logs or backups | Encrypt stored data, avoid logging secrets |
| Jailbreak or rooting | Removing the platform's built-in restrictions, which disables many protections | Detect rooted or jailbroken devices, use mobile device management |
| Permission abuse | An app requesting far more access than it needs, such as contacts, location or messages | Least-privilege permissions, app vetting |
Mobile assessment tools include the Mobile Security Framework (MobSF) for static and dynamic analysis of app packages, Frida for inspecting a running app, Drozer for examining Android app components, and the Android Debug Bridge (ADB) as the command-line link to an Android device. Know their purpose, not their operation.
Operational technology
OT covers industrial control systems such as programmable logic controllers (PLCs) and the protocols that link them. Many were designed for closed networks and trust any message on the wire.
| Topic | Idea |
|---|---|
| Register or coil manipulation | Changing PLC values over an unauthenticated protocol, which can alter a physical process |
| CAN bus attack | Injecting frames on a vehicle Controller Area Network bus that has no built-in authentication |
| Modbus weakness | Modbus (often on Transmission Control Protocol port 502) has no authentication or encryption |
| Plaintext attack | Reading or altering cleartext OT or IoT traffic on the wire |
Defences are segmentation of OT from information technology networks, monitoring with OT-aware tools, gateways that add authentication, and passive testing only, because active probing can disrupt a live process.
Short-range wireless and tag systems
| Topic | Idea | Defence |
|---|---|---|
| Near-field communication (NFC) | Skimming or relaying a contactless session at very short range | Shielding, transaction limits, tokenisation |
| Radio-frequency identification (RFID) | Cloning or skimming access-badge credentials, easiest on low-frequency cards | Higher-frequency encrypted cards, shielding |
| Bluejacking | Sending unsolicited messages over Bluetooth, unlike bluesnarfing which tries to take data | Make devices non-discoverable |
| Bluetooth spamming | Flooding nearby devices with pairing or advertisement requests | Disable Bluetooth when unused, update firmware |
Scapy builds and decodes custom packets, tcprelay forwards a port such as a link to a universal serial bus connected device, and Bluestrike is a Bluetooth assessment tool.
OT and medical devices can fail unsafely under active testing, so confirm a safe window, use passive methods where possible, and get explicit sign-off first.
What to remember for the exam
- Mobile risks are insecure storage, rooting or jailbreaking, and excessive app permissions.
- MobSF, Frida, Drozer and ADB are the named mobile assessment tools.
- OT protocols such as Modbus often have no authentication or encryption.
- Register manipulation changes PLC values and can affect a physical process.
- A CAN bus has no built-in authentication, so injected frames are trusted.
- RFID and NFC attacks clone, skim or relay contactless credentials.
- Bluejacking sends messages, while bluesnarfing tries to steal data.
- Segmentation and passive testing protect fragile OT systems.
Common mistakes
Testing OT like an ordinary network. Aggressive scans can halt a physical process, so OT needs passive and approved methods.
Confusing bluejacking and bluesnarfing. Bluejacking sends unsolicited messages, while bluesnarfing attempts data theft.
Ignoring mobile storage. Much mobile risk is data left unprotected on the device, not a network flaw.
Assuming RFID badges are safe. Low-frequency proximity cards are often easy to clone.
Skipping extra authorisation. Specialized systems frequently need their own scope and safety agreement.
Check yourself
Why are many OT protocols risky?
They were built for trusted networks and often have no authentication or encryption, so messages are accepted without checking.
Which tool performs static and dynamic analysis of mobile app packages?
The Mobile Security Framework (MobSF).
What is the difference between bluejacking and bluesnarfing?
Bluejacking sends unsolicited messages over Bluetooth, while bluesnarfing tries to steal data from the device.
Topic 9 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.