Threats, Vulnerabilities, and Attacks · Topic 4 of 10
Endpoint, Supply Chain, Human and Physical Vectors
Security+ threat vectors: endpoints and living off the land, supply chain and SaaS, malicious USB, visitors, watering holes, IoT, OT, locks and NFC.
- 5 min
- Living-off-the-land attacks use built-in, legitimate tools so that they blend in.
- Trusted devices can be used to move further into the network.
- Supply chain vectors include third parties, MSPs, logistic providers and SaaS providers.
What it is
This page continues the threat vectors from the previous page. It covers the devices people use, the suppliers an organization depends on, removable media, people on site, connected devices, physical barriers and wireless signals.
Many of these vectors bypass network controls entirely. An attacker who walks in, plugs in a device or compromises a supplier may never touch the firewall.
How it works
Endpoint-based vectors
| Vector | Risk |
|---|---|
| Mobile devices and tablets | Lost or stolen, carry company data, connect to untrusted networks |
| Workstations | The usual landing point for phishing and malicious downloads |
| Servers | Exposed services and high value data |
| Trusted devices | A device the network already trusts can be used to move further inside |
| Built-in tools | Administrative tools that come with the operating system, such as command shells and scripting engines |
| Living-off-the-land tools | Legitimate tools used by the attacker so that activity blends in and no new malware is dropped |
Living off the land is hard to detect because the tools are signed and expected. Application control, logging of script and command line activity, and behavior based detection help.
Supply chain-based vectors
| Supplier | Example of risk |
|---|---|
| Third-party providers | A vendor's breached network or software becomes a way into its customers |
| Managed service providers (MSPs) | An MSP has remote access to many clients, so one breach reaches all of them |
| Logistic providers | Hardware can be intercepted or altered in transit |
| Software as a service (SaaS) providers | A breach of the provider exposes the data customers store there |
Defenses include vendor assessment, contract requirements, least privilege for supplier accounts and monitoring of supplier access.
External media-based vectors
A malicious universal serial bus (USB) device may carry malware, or may pretend to be a keyboard and type commands as soon as it is plugged in. Attackers leave such devices in car parks or hand them out as gifts.
Disabling autorun, blocking unapproved devices and training staff not to plug in unknown media close this path.
Human-based vectors
| Vector | How it works |
|---|---|
| Impersonation | Pretending to be a trusted person, such as a manager, help desk technician or delivery driver |
| Contractor | An outside worker with access who may be careless, malicious or compromised |
| Visitor | A guest who is not escorted and reaches areas or ports they should not |
| Biometric | Spoofing a fingerprint or face reader with a copy, photo or mask |
| Watering hole | Compromising a website that the target group is known to visit, then waiting for them to arrive |
In a watering hole attack the target is never contacted directly. Visitor sign in, escorts and badges, and contractor accounts that expire, reduce human vectors.
IoT-based vectors
Internet of Things (IoT) devices such as cameras, sensors and printers are often shipped with default passwords and rarely receive updates. Printers also store copies of documents and may hold stored credentials for email or file shares.
Place IoT devices on a separate network segment, change default credentials and keep firmware current.
OT-based vectors
Operational technology (OT) controls physical processes, such as industrial machinery, utilities and building systems. OT is often old, hard to patch and designed for availability rather than security.
An attack on OT can cause physical damage or danger to people. OT should be segmented from the business network and monitored closely.
Physical-based vectors
| Vector | Risk |
|---|---|
| Lock and key | Locks can be picked, keys copied or left unreturned |
| Access vestibule | A vestibule that lets both doors open at once, or lets two people through on one badge, fails its purpose |
| Access passes | Badges can be lost, shared, borrowed or cloned |
Physical access often leads straight to logical access. An attacker in the server room can unplug, steal or connect equipment.
Signal-based vectors
| Vector | Risk |
|---|---|
| Bluetooth | Attacks on devices with discoverable or unpatched Bluetooth |
| Radio frequency (RF) | Signals can be captured, replayed or jammed |
| Near-field communications (NFC) | Short range reads of payment cards or badges, or a tag that opens a malicious link |
Turn off Bluetooth discovery when it is not needed, patch device firmware and use shielded holders for badges and cards.
What to remember for the exam
- Living-off-the-land attacks use built-in, legitimate tools so that they blend in.
- Trusted devices can be used to move further into the network.
- Supply chain vectors include third parties, MSPs, logistic providers and SaaS providers.
- A malicious USB device can carry malware or act as a keyboard.
- Human vectors include impersonation, contractors, visitors, biometric spoofing and watering holes.
- IoT cameras, sensors and printers often have default credentials and old firmware.
- OT runs physical processes and must be segmented.
- Physical vectors include locks and keys, access vestibules and access passes. Signal vectors are Bluetooth, RF and NFC.
If the scenario says no malware was found but an attacker ran normal admin commands, the answer is living-off-the-land.
Common mistakes
Assuming signed tools are safe. Attackers choose built-in tools exactly because they are trusted and signed.
Ignoring suppliers. A secure organization can still be breached through an MSP or SaaS provider with weaker controls.
Treating printers as harmless. They store documents and credentials, and are rarely patched.
Confusing a watering hole with phishing. Phishing sends the victim a lure. A watering hole infects a site the victim already visits.
Check yourself
Why are living-off-the-land techniques hard to detect?
The attacker uses legitimate, trusted tools already on the system, so no new malware appears.
Why is a managed service provider a high value target?
It has trusted remote access to many customers, so one breach can reach all of them.
What is a watering hole attack?
Compromising a website the target group is known to visit and infecting them when they arrive.
Topic 4 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.