CompTIA_Security+_2.2_Explain common threat vectors and attack surfaces.

2.2 解释常见的威胁途径和攻击面

摘要

  • 2.2.1 Message-based（基于消息的）
    • Email
    • Short Message Service (SMS)（短信）
    • Instant messaging (IM)（即时通讯）
  • 2.2.2 Image-based（基于图片的）
  • 2.2.3 File-based（基于文件的）
  • 2.2.4 Voice call（语音通话）
  • 2.2.5 Removable device（可移动设备）
  • 2.2.6 Vulnerable software（易受攻击的软件）
    • Client-based vs. agentless（基于客户端的 vs. 无代理模式）
  • 2.2.7 Unsupported systems and applications（不受支持的系统和应用程序）
  • 2.2.8 Unsecure networks（不安全的网络）
    • Wireless（无线的）
    • Wired（有线的）
    • Bluetooth
  • 2.2.9 Open service ports（开放服务端口）
  • 2.2.10 Default credentials（默认凭证）
  • 2.2.11 Supply chain（供应链）
    • Managed service providers (MSPs)（管理服务提供商）
    • Vendors（代理商）
    • Suppliers（供应商）
  • 2.2.12 Human vectors/social engineering（人力传播/社会工程学）
    • Phishing（网络钓鱼）
    • Vishing（语音欺诈）
    • Smishing（短信欺诈）
    • Misinformation/disinformation（误导消息/虚假消息）
    • Impersonation（伪装）
    • Business email compromise（商业电子邮件欺诈）
    • Pretexting（假托身份）
    • Watering hole（水坑攻击）
    • Brand impersonation（品牌冒充）
    • Typosquatting（错误拼写域名抢注）

Threat vectors

A method used by the attacker

  • Gain access（访问权限）or infect（感染）to the target
  • Also called "attack vectors"（攻击途径）

A lot of work goes into finding vulnerabilities in these vectors（在这些威胁渠道中发现漏洞需要投入大量的工作）

  • Some are more vulnerable than others

IT security professional spend their career（在其职业生涯中）watching（密切关注）these vectors

  • Protect existing vectors
  • Find new vectors

2.2.1 Message-based vectors

One of the biggest (and most successful) threat vectors

  • Everyone has at least one of these messaging systems

Email

  • Malicious（恶意的）links in an email
  • Link to malicious site

SMS (Short Message Service)

  • Attacks in a text message

Phishing attacks

  • People want to click links
  • Links in an email, links send via text or IM

Deliver the malware to the user

  • Attach（添加）it to the email
  • Scan all attachments, never launch untrusted links

Social engineering attacks

  • Invoice（发票）scams（诈骗）
  • Cryptocurrency（加密货币）scams

2.2.2 Image-based vectors

Easy to identify a text-based threat

  • It's more difficult to identify the threat in an image

Some image formats（格式）can be a threat

  • The SVG (Scalable Vector Graphic)（可缩放矢量图形）format
  • Image is described in XML (Extexsible Markup Language)（可扩展标记语言）

Significant（严重的）security concerns（问题）

  • HTML injection
  • Javascript attack code

Browsers must provide input validation

  • Avoids running malicious code

526e2efd7c19f6c94e4d764f7ba7da48

2.2.3 File-based vectors

More than just executables（可执行文件）

  • Malicious code can hide in many places

Adobe PDF

  • A file format containing other objects

ZIP/RAR files (or any compression（压缩文件）type)

  • Contains many different files

Microsoft Office

  • Documents with macros（宏）
  • Add-in（插件）files

2.2.4 Voice call vectors

Vishing（语音钓鱼）

  • Phishing over the phone

Spam over IP

  • Large-scale phone calls

War dialing（拨号攻击）

  • 利用软件自动、大规模地拨打一个电话号段（如一个区号内的所有号码），以扫描并发现那些连接了调制解调器、传真机或计算机系统的电话号码。它既可以被攻击者用于寻找网络入侵的入口，也可以被安全人员用作防御性的安全检测手段。
  • It still happens

Call tampering（呼叫篡改）

  • Disrupting voice calls（干扰语音通话），一种针对语音通话（尤其是VoIP网络电话）的主动攻击手段。它通过在通话建立后，实时注入、丢弃或篡改数据包，来破坏通话质量、窃听内容或进行欺诈，最终达到骚扰、勒索或窃取信息的目的。

2.2.5 Removable device vectors

Get around the firewall

  • The USB interface（接口）

Malicious software on USB flash（闪存）drives

  • Infect air gapped networks（物理隔离/气隙网络）
  • Industrial（工业的）systems, high-security services

USB devices can act as keyboards

  • Hacker on a chip（芯片）

Data exfiltration（泄露）

  • Terabytes（数太字节（表示大量的数据量））of data walk out the door
  • Zero bandwidth（带宽）used

2.2.6 Vulnerable software vectors

Client-based

  • Infected executable
  • Known (or unknown) vulnerablilties
  • May require constant（持续）updates

Agentless

  • No installed executanle
  • Compromised（受损的）software on the server would affect all users
  • Client runs a new instance（实例）each time

2.2.7 Unsupported systems vectors

Patching is an important prevention tool（手段）

  • Ongoing（持续的）security fixes（修复措施）

Unsupported systems aren't patched

  • There may not even be an option

Outdated operating systems

  • Eventually, even the manufacturer won't help

A single system could be an entry（入口）

  • Keep your inventory（库存）and records（记录）current（保持最新状态）

2.2.8 Unsecure network vectors

The network connects everything

  • Ease（容易）of access for the attackers
  • View all (non-encrypted) data

Wireless（无线的）

  • Outdated（过时的）security protocols (WEP, WPA, WPA2) - 需要考虑升级到最新的 WPA3 协议
  • Open or rogue（非法的）wireless networks

Wired

  • Unsecure interfaces - No 802.1X（未采用 802.1X 协议 - 一种身份验证协议，可防止任何人在未提供正确凭据的情况下访问网络）

Bluetooth

  • Reconnaissance（侦察），可用于确定特定系统的位置等
  • Implementation vulnerabilities（实施漏洞）

2.2.9 Open service ports

Most network-based services connect over a TCP or UDP port

  • An "open" port

Every open port is an opportunity for the attacker

  • Application vulnerability（应用程序漏洞）or misconfiguration（配置错误）

Every application has their own open port

  • More services expand the attack surface

Firewall rules

  • Must allow traffic to an open port

2.2.10 Default credentials（默认凭证）

Most devices have default usernames and passwords

The right credentials provide full control

  • Administrator access

Very easy to find the defaults for your access point or router

2.2.11 Supply chain（供应链）vectors

Tamper（破坏）with the underlying infrastructure（底层基础设施）

  • Or manufacturing process（制造流程）

Managed service providers (MSPs)（托管服务商）

  • Access many different customer networks from one location

Gain access to a network using a vendor

  • 2013 Target（塔吉特公司）credit card breach（泄露）

Suppliers

  • Counterfeit（伪造的）networking equipment
  • Install backdoors, substandard performance（性能低下）and availability
  • 2020 - Fake Cisco Catalyst 2960-X switches

2.2.12 Human vectors（以人为途径）/social engineering

Phishing

Social engineering with a touch of（一些）spoofing（欺骗）

  • Often delivered by email, text, etc.
  • Very remarkable（效果显著）when well done（执行得当）

Don't be fooled（被迷惑）

  • Check the URL

Usually there's something not quite right（通常总会有一些不太妥当的地方）

  • Spelling, fonts（字体）, graphics（图形）

2f552e75337ba22030f4c6b4eb6cc104

17fc47119ac943c6093bb012e9ec8d79

Business email compromise

We trust email sources

  • The attackers take advantage of（利用）this trust（信任心理）

Spoofed（伪造的）email addresses

  • Not really a legitimate emaill address
  • professor@professormessor.com

Financial fraud（欺诈）

  • Sends emails with updated bank information
  • Modify wire transfer（电汇）details

The recipient clicks the links

  • The attachments have malware（恶意软件）

Tricks and disinformation

How are they so successful?

  • Digital（数字化的）slight of hand（巧妙手段）
  • It fools（愚弄）the best（最聪明）of us

Typosquatting

Pretexting

  • Lying（说谎）to get information
  • Attacker is a character in a situation（情境）they create
  • Hi, we're calling from Visa regarding an automated payment to your utility service...

Phishing with different bait（诱饵）

Vishing (Voice phishing) is done over the phone or voicemail

  • Caller ID spoofing is common（呼叫者身份伪装现象很常见）
  • Fake security checks or bank updates

Smishing (SMS phishing) is done by text message

  • Spoofing is a problem here as well
  • Forwards links or asks for personal information
    74fb58310b76148d08d8c92ec9f89496

Variations（变体）on a theme

  • The fake check scam（骗局）, phone verification code scam, Boss/CEO scam, advance-free scam
  • Some great summaries on https://reddit.com/r/Scams

Impersonation（伪装）

The pretext

Before the attack, the trap is set

  • There's an actor and a story

"Heloo sir, my name is Wendy and I'm from Microsoft Windows. This is an urgent check up call for your computer as we have found several problems with it."

Voice mail:"This is an enforcement action executed by the US Treasury intending your serious attention"

"Congratuations on your excellent payment history! You now qualify for 0% interest rates on all of your credit card accounts."

Impersonation

Attackers pretend to be someone they aren't

  • Halloween（万圣节）for the fraudsters（诈骗者）

Use some of those details from reconnaissance（侦察工作）

  • You can trust me, I'm with your help desk

Attack the victim as someone higher in rank

  • Office of the Vice President（副总裁）for Scamming（诈骗事务）

Throw tons of technical details around（罗列大量技术细节）

  • Catastrophic feedback due to the depolarization of the differential magnetometer（由于差分磁力计极性反转而产生的灾难性反馈）

Be a buddy

  • How about those Cubs?

Eliciting information（获取信息）

Extracting information from the victim

  • The victim doesn't even realize this is happening
  • Hacking the human

Often seen with vishing (Voice Phishing)

  • Can be easier to get this information over the phone

These are well-documented（有充分证据证明的）psychological techniques

  • They can't just ask, "So, what's your password?"

Identity fraud（盗窃）

Your identity can be used by others

  • Keep your personal information safe!

Credit card fraud

  • Open an account in your name, or use your credit card information

Bank fraud

  • Attacker gains access to your account or opens a new account

Loan（贷款）fraud

  • Your infromation is used for a loan or lease

Government benefits（政府福利）fraud

  • Attacker obtains benefits on your behalf

Protect against impersonation（冒充）

Never volunteer information

  • My password is 123456

Don't disclose（透露）personal details

  • The bad guys are tricky（狡猾）

Always verify before revealing info（透露信息）

  • Call back, verify through 3rd parties

Verification should be encouraged

  • Especially if your organization owns valuable information

Watering hole attack

利用目标群体常常访问的特定网站进行攻击的方式。 攻击者通过感染这些受害者常去的网站，实现对其系统的侵入。

What if your network was really secure?

  • You didn't even plug in that USB key from the parking lot

The attackers can't get in（进入）

  • Not responding to phishing emails
  • Not opening any email attachments

Have the mountain come to you

  • Go where the mountain hangs out
  • The watering hole
  • The requires a bit of research

Executing（实施）the watering hole attack

Determine which website the victim group uses

  • Educated guess（依据推测判断）- Local coffee or sandwich shop
  • Industry-related（行业相关）sites

Infect（感染）one of these third-party sites

  • Site vulnerability
  • Email attachments

Infect all visitors

  • But you're just looking for specific victims
  • Now you're in!

Because that's where the momey is

January 2017

Polish Financial Supervision Authority, National Banking and Stock Commission of Mexico, State-owned bank in Uruguay

  • The watering hole was sufficiently poisoned

Visiting the site would download malicious JavaScript files

  • But only to IP addresses matching banks and other financial institutions

Did the attack work?

  • We still don't know

Watching the watering hole

Defense-in-depth（纵深防御）

  • Layered defense（分层防御）
  • It's never one thing（永远不是单一措施就能解决问题的）

Firewalls and IPS：通常捆绑在一起

  • Stop the network traffic before things get bad

Anti-virus / Anti-malware signature updates

  • The Polish Financial Spuervision Authority attack code was recognized and stopped by generic signatures Symantec's anti-virus software

Misinformation（误导信息）/disinformation（虚假信息）

Disseminate（传播）factually（事实上）incorrect（不准确的）information

  • Create confusion（混乱）and division（分裂）

Influence campaigns（影响力活动）

  • Sway（影响）public opinion（公共舆论）on political（政治）and social issues（社会议题）

Nation-state（国家层面）actors

  • Divide, distract（分散注意力）, and persuade（劝说）

Advertising（广告）is an option

  • Buy a voice（声音通道）for your option

Enabled through Social media

  • Creating, sharing, liking, amplifying（放大）

The misinformation process
cec3e69b4693339841ca0ca8d49afe8e

Brand impersonation

Pretend（假装）to be a well-known brand

  • Coca-cola, McDonald's, Apple, ect.

Create tens of thousands（数万个）of impersonated sites

  • Get into the Google index（谷歌索引）, click an ad, get a WhatsApp message

Visitors are presented with a pop-up（弹出窗口）

  • You won! Special offer! Download the video!

Malware infection is almost guaranteed（无可避免的）

  • Display ads, site tracking（网站追踪）, data exfiltration（数据泄露）
posted @ 2026-01-24 22:34  Guanz  阅读(41)  评论(0)    收藏  举报