3.2.2. Network and System Vectors
💡 First Principle: Network vectors exploit the fundamental reality that networked systems must accept some incoming connections to function. Every open port, every running service, and every protocol implementation is a potential entry point. The attack surface of a networked system is the sum of all its reachable interfaces.
Unsecured wireless networks allow attackers to intercept traffic, perform man-in-the-middle attacks, or join the network directly. Rogue access points mimic legitimate networks (evil twin attacks) to capture credentials. Even encrypted wireless networks can be attacked if using weak protocols like WEP or WPA2-Personal with short passphrases.
Open service ports expose services to attack. Every open port runs software that may have vulnerabilities. Port scanning identifies these services; vulnerability scanning identifies their weaknesses. Minimize attack surface by closing unnecessary ports and running only required services.
Default credentials on network devices, IoT devices, and applications remain a surprisingly common vector. Many devices ship with "admin/admin" or "admin/password" and are never changed. Automated tools scan the internet for devices with known default credentials — Mirai botnet compromised hundreds of thousands of IoT devices using just 60 default username/password combinations.
Vulnerable software — unpatched operating systems, applications, and firmware contain known vulnerabilities that attackers exploit with readily available tools. Exploit frameworks like Metasploit make exploitation accessible even to less skilled attackers.
Operating system (OS) vulnerabilities specifically target the OS kernel, services, or security features. OS-level compromise gives attackers the highest privilege possible, often enabling complete control of the system and lateral movement to other systems.
Bluetooth attacks exploit the short-range wireless protocol for unauthorized pairing (bluejacking), data theft (bluesnarfing), or device tracking. While range is limited, Bluetooth attacks are effective in public spaces where devices are in close proximity.
Where vectors fit — the cyber kill chain. Lockheed Martin's Cyber Kill Chain models an intrusion as seven ordered stages: reconnaissance (research the target), weaponization (pair an exploit with a payload), delivery (send it through a vector such as email, a web download, or removable media), exploitation (the exploit triggers a vulnerability), installation (plant a persistent foothold such as a backdoor), command and control (open a remote channel back to the attacker), and actions on objectives (data theft, encryption, disruption). Each stage enables the next, so defenders can stop the attack by breaking the chain at any one of them.
⚠️ Exam Trap: Default credentials aren't just a "lazy admin" problem — they're a recognized threat vector. IoT devices are especially problematic because many don't support credential changes or firmware updates. The Mirai botnet demonstrated the scale of this vulnerability.
