TyscorpaAttack Surface vs. Attack Vector
- Attack Surface: The total set of entry points an attacker could use (all software, protocols, interfaces, people)
- Attack Vector: A specific pathway used to carry out an attack
- Reducing attack surface is a key security principle — disable unused services, close open ports, remove unnecessary software
Message-Based Vectors
| Attack | Description | Example / Tip |
|---|---|---|
| Phishing | Bulk deceptive emails impersonating trusted entities | "Your account is suspended — click here" |
| Spear Phishing | Targeted phishing using personalized information | Email to CFO referencing a real project |
| Whaling | Spear phishing targeting senior executives (CEO, CFO) | Fake legal subpoena targeting the CEO |
| Vishing | Voice phishing via phone call | Caller impersonating IT support asking for password |
| Smishing | SMS-based phishing | "Your package is delayed — click link to reschedule" |
| Pharming | Redirecting DNS so victim goes to fake site (even with correct URL) | DNS poisoning to redirect bank.com to attacker server |
| Typosquatting | Registering misspelled domain names | gooogle.com, paypa1.com |
| BEC (Business Email Compromise) | Impersonating executives or vendors to authorize fraudulent wire transfers | CEO fraud — attacker spoofs CEO's email to CFO |
Social Engineering Principles
Attackers exploit psychological weaknesses. Key principles used:
- Authority: "I'm from the IT department and need your credentials to fix an issue"
- Urgency: "You must act NOW or your account will be deleted"
- Intimidation: Legal threats, fake law enforcement contact
- Scarcity: "Only 2 spots left — register today"
- Social Proof: "Everyone else has already signed up"
- Liking: Building rapport before making a request
- Fear: Scare tactics triggering impulsive action
- Consensus: "Your colleague approved this already"
Supply Chain Attack Surface
Attackers compromise a trusted vendor/partner to gain access to the target organization.
Notable Examples:
- SolarWinds (2020): Nation-state actors (Cozy Bear) inserted malicious code into SolarWinds Orion software updates. ~18,000 organizations installed the backdoor.
- Target Breach (2013): Attackers compromised an HVAC vendor's credentials to gain access to Target's network.
- Log4Shell (2021): Vulnerability in the Log4j open-source library affected millions of applications.
Countermeasures: Software Bill of Materials (SBOM), vendor assessments, code signing, integrity checks on updates.
Other Threat Vectors
- Removable Media: USB drives with malware — e.g., "USB drop attack" in a parking lot
- Vulnerable Software: Unpatched applications, outdated libraries
- Unsupported Systems: End-of-life OS (Windows XP, Server 2008) — no security patches
- Open Service Ports: Unnecessary open ports expand attack surface
- Default Credentials: IoT devices, routers shipped with admin/admin — never changed
- Unsecure Networks: Open Wi-Fi, unencrypted communications, rogue access points
- Voice Calls: Vishing — social engineering over phone; AI-generated voice cloning
- Image-Based: Malicious images exploiting rendering vulnerabilities (e.g., steganographic payloads)
Exam Tip: The exam loves scenario questions about social engineering. Key identifiers: the attack uses deception, exploits human psychology, and doesn't rely on technical exploits. Countermeasure = security awareness training.