Threats, Vulnerabilities, and Attacks · Topic 3 of 10
Message, File, Browser and Network Vectors
Security+ threat vectors: APTs, email, SMS, RCS and chat, QR codes and fake CAPTCHAs, macros and PDFs, browser extensions, cookies and remote access.
- 5 min
- An APT is a skilled, patient attacker that stays hidden for a long time.
- Message vectors are email, SMS, RCS, instant messaging and collaboration tools.
- Image vectors include QR codes, embedded content and fake CAPTCHA pages.
What it is
A threat vector (also called an attack vector) is the path an attacker uses to reach a target. This page covers the vectors that reach people and systems through messages, images, attachments, the browser, the network and remote access tools.
The next page covers endpoints, suppliers, people, physical access and radio signals. Together they make up the threat vectors and sources the exam lists.
How it works
Advanced persistent threat (APT)
An APT is a skilled, well resourced attacker, often state-sponsored, that gains access and stays hidden for a long time. It uses many of the vectors below, one after another, to get in, move around and keep its foothold.
Patience is the mark of an APT. Detection depends on spotting small signs over time, not one loud event.
Message-based vectors
| Vector | How it is abused |
|---|---|
| Phishing links, malicious attachments, fake invoices | |
| Short Message Service (SMS) | Text messages with links or urgent requests |
| Rich Communication Services (RCS) | Richer messaging that replaces SMS on many phones, carrying links, images and files in the same way |
| Instant messaging | Chat apps used to send links or files |
| Collaboration tools | Shared workspaces and chat channels where a fake colleague or a compromised account posts links and files |
Collaboration tools are trusted because messages seem to come from inside the organization. External access settings and the same link and file scanning used for email reduce the risk.
Image-based vectors
| Vector | How it is abused |
|---|---|
| Quick response (QR) codes | A code that hides a malicious link, often stuck over a real one on a poster or parking meter |
| Embedded content | Images, scripts or remote content inside a message or page that load from an attacker's server or carry code |
| CAPTCHA | A fake "prove you are human" check that tells the user to copy and run a command, or hides a phishing page from automated scanners |
A QR code is risky because the user cannot read the address before scanning. Phones that preview the address before opening it help.
Attachment-based vectors
| Vector | How it is abused |
|---|---|
| Embedded macros | Scripts in office documents that run when the user enables content |
| Rich Text Format (RTF) documents | Documents that can embed objects and have been used to deliver exploits |
| Portable Document Formats (PDFs) | Files that can carry links, scripts or embedded files |
Blocking macros in files from the internet, opening attachments in a sandbox and filtering file types at the email gateway are the main controls.
Browser-based vectors
| Vector | How it is abused |
|---|---|
| Extensions | An add-on that reads pages, steals data or is sold to a new owner who adds malicious code |
| JavaScript | Malicious script on a compromised or attacker site that runs in the visitor's browser |
| Password managers | A weak master password or a compromised manager exposes every stored credential |
| Cookies | Stolen cookies can carry a logged in state to the attacker |
| Session tokens | A stolen token lets the attacker reuse a session without the password or MFA |
Allow lists for extensions, short session lifetimes and binding sessions to the device reduce these risks.
Network-based vectors
| Vector | How it is abused |
|---|---|
| Infrastructure devices | Routers, switches and firewalls with old firmware, default credentials or exposed management interfaces |
| Virtualized devices | Virtual appliances and hosts that are forgotten, unpatched or reachable from the wrong network |
| Session keys | Stolen or weak keys let an attacker decrypt or take over an encrypted session |
Infrastructure devices are attractive because they sit in the path of all traffic and are rarely monitored like servers.
Remote access vectors
| Vector | How it is abused |
|---|---|
| Remote desktop | Remote Desktop Protocol (RDP) exposed to the internet, attacked by password guessing or known flaws |
| Virtual Network Computing (VNC) | Remote control software, sometimes left with weak or no password |
| Virtual private network (VPN) | A VPN gateway with an unpatched flaw or accounts without MFA |
Never expose remote desktop directly to the internet. Put remote access behind a patched VPN or gateway with MFA, and log every session.
What to remember for the exam
- An APT is a skilled, patient attacker that stays hidden for a long time.
- Message vectors are email, SMS, RCS, instant messaging and collaboration tools.
- Image vectors include QR codes, embedded content and fake CAPTCHA pages.
- Attachment vectors include macros, RTF documents and PDFs.
- Browser vectors include extensions, malicious JavaScript, password managers, cookies and session tokens.
- A stolen session token or cookie can bypass the password and MFA.
- Network vectors include infrastructure devices, virtualized devices and session keys.
- Remote desktop, VNC and VPN gateways need patching, MFA and no direct exposure.
If a user "verified they were human" by pasting a command into a run box, the vector is a fake CAPTCHA.
Common mistakes
Treating internal chat as safe. Collaboration tools carry phishing links just like email, often from a compromised internal account.
Thinking MFA protects a stolen session. Once the session token is taken, the attacker skips the login entirely.
Trusting an extension forever. An extension that was safe can turn malicious after an update or a change of owner.
Forgetting network devices. A router or VPN appliance with an old flaw can be a direct way into the network.
Check yourself
Why is a QR code a useful vector for attackers?
The user cannot see the destination before scanning, so a malicious link is easy to hide.
How can an attacker use a stolen session token?
They reuse the logged in session without needing the password or MFA.
What is the safest way to offer remote desktop access?
Keep it off the internet and reach it through a patched VPN or gateway that requires MFA.
Topic 3 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.