Various kinds of Attack Vectors
A cyber-criminal of today has numerous vectors at his disposal, and they use them according to the nature of the hack and the various vulnerabilities present in the target systems. Some of the common vectors for delivering payload are mentioned below.
- Phishing - Phishing utilizes the most common and readily available vector, the lack of awareness of network administrators or company employee. A payload containing email or pop-up message is usually sent where the innocuous looking content hides harmful malware. Once the mail is accessed or the attachment opened, the payload is automatically downloaded in the target system.
- Drive - by downloads- Another popular attack vector includes drive-by downloads. In this case, legitimate websites are infected with malicious payload, and the systems can get compromised due to un-informed downloads without the knowledge of the system user. Such vectors include accessing the website, reading a particular email, clinking on a harmless looking link on the legitimate website or by accessing pop-ups. Drive-by downloads also search for system loopholes and exploits.
- Domain Shadowing - Hackers who gain access to domain registrar credentials (usually done through phishing) can gain access to an organization's DNS server and can then begin to redirect traffic to a malicious IP. The user might enter a trusted URL but will be redirected to a malicious page filled with landmines that are itching to infect systems upon accessing them.
A threat analysis usually involves taking note of and fixing all such attack vectors.
Related Article: Phishing and it's Variants