4.1 - Device Vulnerabilities and Attacks
Types of Computing Devices
Servers provide services to other computers on a network, typically with beefier processing power and storage than a regular workstation. Common types include DNS servers (translating domain names to IPs), DHCP servers (assigning IP addresses automatically), file servers (centralized shared storage), email servers, web servers, and database servers. For example, a business might deploy a file server with 20 TB of storage and dual processors serving 50 employees, versus individual workstations with much smaller storage meant for one person's use.
Being a server is about the job, not the hardware. Any computer can act as a server if it provides a service to other computers, like an FTP server that lets other computers upload and download files. Servers in a business just tend to have more processing power and storage than a personal computer, since they handle requests from many users at once.
Personal computers are built for individual use, whether desktops (stationary, high performance, easy to upgrade), laptops (portable, battery-powered, a balance of power and mobility), or notebooks (smaller and lighter, prioritizing portability and battery life over raw performance). Common uses span word processing, design, browsing, media, development, and gaming.
Handheld computers (also called mobile computers or information appliances) are smaller, battery-powered mobile devices, including smartphones (pocket-sized, touchscreen, cellular, cameras, apps, often someone's primary computing device), tablets (bigger screens between phone and laptop size, good for media and light productivity), and wearables like smartwatches and fitness trackers for health tracking and quick notifications. These generally have less processing power than PCs, optimized instead for battery life and touch, running mobile operating systems like iOS or Android.
Embedded computers are purpose-built devices integrated into machines with specific, limited instruction sets, offering limited processing power and storage, lower cost, often real-time operating requirements, and usually no user programmability. For example, a car's engine control unit constantly monitors sensors and adjusts fuel injection timing thousands of times a second, but it has exactly one job and can't do anything else.
IoT devices are everyday objects with embedded computers providing connectivity and smart features, spanning transportation (cars, trains, planes), critical infrastructure (electrical grids, water treatment, industrial control systems), medical equipment (IV pumps, MRI scanners, pacemakers, insulin pumps), and consumer devices (smart thermostats, locks, cameras, appliances, TVs, voice assistants). A big security concern here is that a lot of IoT devices ship with weak default passwords, rarely get security updates, and connect directly to the internet, making them easy targets that can get roped into DDoS botnets, used for surveillance, or exploited as an entry point into a larger network.
A quick way to tell the device types apart:
Type | What gives it away | Examples |
Server | Provides one or more services to other computers, usually with more processing power and storage | DNS, DHCP, FTP, email, and web servers |
Personal computer | Built for one person's work or recreation | Desktops, laptops, notebooks |
Handheld computer | Smaller than a personal computer and runs on battery power | Smartphones, tablets, smartwatches |
Embedded computer | Part of a machine, with one specific job, minimal storage, and low cost | A car's engine control unit, the controller in an insulin pump |
IoT device | An everyday device with an embedded computer, usually connected to a network | Smart thermostats, connected washing machines and coffee makers, pumps at a water treatment plant |
Types of Malware
Malware is malicious software that damages devices or networks, or gives an attacker unauthorized access. It's worth remembering malware is usually just a tool used toward a bigger goal, like data theft or financial gain, not the end goal itself.
Viruses need a person to activate them, since they attach to legitimate files and only execute when someone opens an infected file or runs an infected program, then they can spread further when infected files get shared. For example, a user opens an email attachment named to look like a PDF but is actually an executable, which infects other documents on the system and spreads through the user's email contacts, but none of that happens until the user actually double-clicks it.
Worms spread themselves across networks without any human interaction at all, exploiting network vulnerabilities directly. The WannaCry worm, for example, exploited a Windows SMB vulnerability, automatically scanning for and infecting other vulnerable systems the moment one machine got infected, spreading to hundreds of systems within minutes with no one clicking anything. The key difference from viruses: viruses need a person to spread an infected file, while worms spread entirely on their own through network flaws.
Trojans disguise themselves as legitimate, harmless software, getting voluntarily installed by users who think they're getting something useful, and unlike viruses or worms, they don't self-replicate. A Remote Access Trojan (RAT) is a specialized version that gives an attacker full remote control, letting them view and control the screen, access and steal files, activate the webcam or mic, log keystrokes, install more malware, or use the machine as a launchpad for other attacks. For example, someone downloads a fake "free" version of paid software from an untrusted site, which installs a RAT alongside what looks like a working program, giving the attacker complete, unnoticed remote access.
Ransomware encrypts a victim's files and demands payment to unlock them. It typically gets in through phishing, an exploit, or a drive-by download, encrypts documents and databases with strong encryption, displays a ransom demand (usually in cryptocurrency) with a countdown threatening permanent data loss or a rising price, and sometimes also threatens to publish stolen data for extra pressure. Even paying doesn't guarantee you get a working decryption key back, and it funds further criminal activity. Modern variants add double extortion (encrypt plus threaten to leak data) or even triple extortion (also threaten the victim's customers or partners).
Spyware quietly tracks what a user does and sends that info to an attacker, things like websites visited, apps used, documents opened, passwords typed, screenshots, messages read, location, and search history. For example, corporate espionage spyware on an engineer's computer might capture design drawings, take periodic screenshots, log every project-related email, and quietly send it all to a competitor, giving them complete insight into product development the victim never knows about.
Keyloggers record every keystroke and send it to an attacker, either through software running in the background or a physical hardware device inserted between keyboard and computer. They can capture usernames and passwords as they're typed, sensitive data like credit card numbers, private messages, and even encryption passphrases. For example, a hardware keylogger secretly plugged into an office computer over a couple weeks might capture login credentials, banking info, and confidential business details, all recoverable once the attacker physically retrieves the device.
Logic bombs sit dormant until a specific condition is met, like a certain date, an OS version, the presence or absence of a file, a specific user logging in, or a certain number of reboots. For example, a disgruntled IT admin might plant code that only deletes company data after a certain date and only if their own account has already been removed from the system, meaning it triggers specifically once they've been fired. These are especially hard to detect since they look like completely normal code until the trigger condition actually fires.
Rootkits integrate deep into an operating system, controlling nearly everything while staying hidden, capable of hiding processes from Task Manager, hiding files from the file explorer, hiding network connections from monitoring tools, intercepting system calls, disabling security software, and evading antivirus scans entirely, all while persisting through reboots. They can install at the application level, the kernel level (very high privilege), the boot level (loading before the OS even starts), or even the firmware level (surviving a full hard drive replacement). A kernel-level rootkit can make Task Manager show only normal processes, antivirus come back clean, network monitors show nothing suspicious, and the file system look completely normal, essentially controlling everything the analyst is able to see, making detection nearly impossible without specialized tools or a clean forensic boot.
Fileless malware lives only in memory, using legitimate built-in tools like PowerShell or WMI to do its damage without ever writing a file to disk, which means it evades traditional file-based antivirus scanning entirely and is much harder to forensically analyze. For example, a phishing link loads a malicious script directly into memory, which connects to a command server, downloads more into RAM, uses built-in Windows tools to explore the network and steal credentials, moves laterally, and exfiltrates data, all without a single file ever touching the hard drive, meaning traditional antivirus scanning finds nothing since it's looking at files that were never created.
Telling Malware Types Apart
To name the malware in a scenario, look for what it does and how it got there:
Malware | What it does | Clue in a scenario |
Virus | Runs only when a user opens or runs an infected file | Trouble starts right after someone opens an attachment or runs a download |
Worm | Spreads from computer to computer on its own, with no human interaction | Many machines get infected quickly and no one clicked anything |
Trojan | Hides inside software that seems harmless | A "free" tool or game that also installed something else |
Remote access trojan (RAT) | A trojan that gives the adversary remote access to the system | The mouse moves on its own, the webcam light turns on, or files change while no one is using the device |
Ransomware | Encrypts the device's files and demands payment for the decryption key | Files won't open and a ransom note with a deadline appears |
Spyware | Tracks what the user does and sends it to the adversary | The adversary knows which sites the user visited or what documents they opened |
Keylogger | Records keystrokes (as software or a small hardware device) for the adversary | Passwords stolen right after being typed, or an unknown device plugged in between the keyboard and the computer |
Logic bomb | Sits dormant until a set condition is met, like a date or an operating system version | Damage that starts on a specific date or right after a specific event |
Rootkit | Gets into the operating system, controls nearly everything, and hides itself | Security tools say everything is fine even though the system is clearly compromised |
Fileless malware | Lives in RAM and uses legitimate programs already installed on the device | Nothing malicious found on the drive, but built-in tools like PowerShell are doing strange things |
How Adversaries Exploit Device Vulnerabilities
Unpatched software leaves known flaws open for exploitation, letting attackers crash systems, spy on users, take control of components like webcams, gain full device control, or steal and destroy data. The WannaCry-exploited Windows SMB vulnerability let attackers send crafted packets to execute code remotely with the highest level of system privileges, no authentication needed, enabling ransomware deployment, backdoors, data theft, and further spreading. Regular patching is essential, since even one unpatched server can compromise an entire network.
Weak authentication gets bypassed through dictionary attacks (trying common passwords), credential stuffing (using passwords leaked elsewhere), password spraying (trying one common password across many accounts to dodge lockouts), brute force (trying every possible combination), or social engineering like phishing, pretexting, or impersonating IT support over the phone. For example, a medical records system left on a default password like
admin123 with no MFA could be cracked in just a few guesses, exposing tens of thousands of patient records, a clear reminder that even strong technical security means nothing if credentials themselves are weak.BIOS/UEFI vulnerabilities: the BIOS (basic input output system), or its newer replacement UEFI (unified extensible firmware interface), is the firmware that starts a computer before the operating system loads. When there's no BIOS or UEFI password set, anyone with physical access can reboot into a special mode (like recovery mode) that gives them higher-level privileges, or boot their own operating system from an external drive, mount the victim's hard drive while completely bypassing the OS login, and then reset the admin password, create a new admin account, or copy everything off. For example, a stolen laptop with no BIOS password gets booted from a USB Linux drive, its hard drive mounted, and its admin password reset using specialized tools, giving the attacker full access to files, email, and saved credentials. A BIOS or UEFI password prevents this kind of unauthorized boot tampering even with physical access.
Autorun exploitation takes advantage of drives automatically executing programs the moment they're connected. Attackers load malware onto USB drives, sometimes labeling them enticingly ("Executive Salary Info") and leaving them in parking lots or lobbies hoping someone's curiosity gets the better of them. The moment a curious employee plugs one in, autorun executes the malware instantly, potentially installing a keylogger, starting network recon, and establishing a command-and-control connection within seconds, all without the employee realizing anything happened. Disabling autorun, blocking USB devices by policy, and training employees about unknown media are the fixes here.
Open ports give attackers direct entry points, since an open port means some service on the device is listening for connections. Commonly exploited ones include SSH (port
22, brute-forceable if exposed), Telnet (port 23, unencrypted, credentials easily sniffed), SMB (port 445, exploited by WannaCry and other worms), RDP (port 3389, a favorite target for ransomware deployment), and database ports like SQL Server (1433) or MySQL (3306) if directly exposed. For example, a small business leaving RDP open to the internet with no account lockout policy gets brute-forced in short order, letting an attacker log in and deploy ransomware across the entire network. Closing unnecessary ports, restricting access through firewalls to authorized IPs, and using strong authentication all help here.Missing or misconfigured firewalls leave devices unable to filter malicious traffic at all, meaning every incoming connection gets allowed, exploit attempts reach vulnerable services unfiltered, and malware can freely communicate outward with command servers. For example, a home user disabling Windows Firewall because "it slows things down" leaves their machine directly exposed, letting an attacker find an outdated service and install a cryptominer. A misconfiguration, like a typo turning "allow traffic from my local network" into "allow traffic from anywhere," can quietly create the same exposure as having no firewall at all. Enabling host-based firewalls everywhere, defaulting to deny, and regularly auditing rules all help prevent this.
Lack of anti-malware software leaves a device wide open to infection through email, downloads, websites, and removable media, since there's nothing scanning files in real time, checking known malware signatures, watching for suspicious behavior, or quarantining and removing threats. For example, downloading a fake "free movie" file that's actually a trojan with no antivirus installed means nothing stops it from executing and quietly granting an attacker remote access for weeks. With antivirus in place, that same download would typically get flagged and blocked immediately on the signature match. Anti-malware isn't perfect and can miss brand-new threats, but it's still an essential layer of protection.
Assessing Device Security Risks
Device vulnerability risk comes down to whether unauthorized access or malware could let an attacker impersonate a user, remotely control a device, encrypt it for ransom, or wipe its data, and how bad that would actually be depends on the device's criticality, what it does, what data it touches, and the overall impact if it were compromised.
Risks from device vulnerabilities usually fall into three levels. High risks could compromise sensitive data or critical operations. Moderate risks come from weak authentication requirements, or from vulnerabilities that are less likely to be exploited. Low risks come from vulnerabilities that would have little impact even if they were exploited.
High risk example: an organization hasn't patched its email server against a critical, publicly known remote code execution vulnerability. Since exploit code is publicly available, email servers are frequently targeted, and this specific flaw is being actively exploited in the wild, likelihood is high. Impact is severe too, since a breach here exposes all company communications, sensitive business data, and customer PII in attachments, likely triggering compliance violations and costing well over $2,000,000 once you add up breach response, fines, and reputational damage. Since it puts sensitive data at risk, this is a high risk that needs immediate patching.
Moderate risk example: a water treatment plant's pump control systems allow remote management with just a username and password, no MFA. Likelihood is moderate since an attacker would first need to find that remote interface and then crack or steal valid credentials, something less commonly attempted than typical business-targeted attacks. Impact is still high though, given the potential for service disruption to thousands of people and even a public safety risk if chemical dosing gets altered, costing an estimated $500,000 in emergency response and reputational fallout. Because the weakness is weak authentication (a single-factor login) that takes a couple of extra steps to exploit, this lands as a moderate risk. It should still get MFA within 30 to 60 days, given how serious the impact would be.
Low risk example: an employee laptop has Telnet listening on port 23. Likelihood is low since an attacker would need to already be on the internal network (meaning the perimeter's already been breached) and would still need valid credentials, and it's just one lower-value personal device rather than anything critical. Impact is low too, since there's minimal sensitive data stored locally (most of it lives in the cloud), and remediation cost is just a few thousand dollars for incident response and reimaging. This is a low risk that can be handled during the next routine maintenance cycle, mainly by just closing that port.
A thorough risk write-up documents the specific vulnerable asset, the technical details of the vulnerability (including CVE numbers), who's likely to exploit it and why, how likely and how damaging exploitation would be, an overall risk rating, and clear mitigation recommendations. For example, a critical SQL Server remote code execution vulnerability on a production database holding 500,000 customer records might be assessed as high likelihood (public exploit code, directly accessible, no compensating controls) and severe impact (potentially $3,500,000+ in fines, response costs, legal fees, and lost business), landing as a critical risk with clear next steps like patching immediately, segmenting the database, adding activity monitoring, and requiring MFA for admin access, all costing a fraction of what an actual breach would. This kind of documentation makes it easy to justify the investment and prioritize fixes clearly.