Topic 4.1 Notes – Device Vulnerabilities and Attacks
What Computing Devices Are
A computing device is any system that runs software and can store, process, or send data. In this course, these are the things adversaries target. The device type matters, but the bigger issue is what the device does, what data it holds, and how much damage compromise would cause.
Main device types
- Server computers provide services to other computers.
- “Server” is a role, not just a powerful machine.
- Common services include DNS, DHCP, FTP, plus email, web, database, and file storage.
- A compromised server often affects many users or the whole organization.
- Personal computers are built for one person’s work or recreation.
- Examples include desktops, laptops, notebooks.
- They get attacked a lot because users open files, browse, install software, and plug in devices.
- Handheld computers are smaller, battery-powered mobile devices.
- Examples include smartphones, tablets, smart watches.
- Mobility adds risk because they move between networks and can be lost or stolen.
- Embedded computers are built into larger machines for specialized tasks.
- They are often slower, cheaper, and have limited storage.
- IoT devices are connected embedded devices such as thermostats, washing machines, IV pumps, or water-treatment controllers.
A laptop and a server can both be vulnerable, but the impact of compromise is often very different. That leads directly into malware, because malware is one of the main ways attackers take advantage of devices.
Types of Malware
Malware means malicious software. It can steal, spy, disrupt, extort, destroy, or give attackers access.
Core categories
- Virus
- Needs user action to start, such as opening an infected file.
- Worm
- Spreads on its own across vulnerable systems without human help.
- Trojan
- Hides inside software that seems useful or harmless.
- Remote access trojan
- A trojan that gives the attacker remote control of the device.
- Ransomware
- Encrypts files and demands payment. Its main CIA effect is availability.
- Spyware
- Watches user activity and sends information back.
- Keylogger
- Records keystrokes to steal things like usernames and passwords. It can be software or hardware.
- Logic bomb
- Triggers only when a condition is met, such as a date, time, or system state.
- Rootkit
- Gains deep OS-level control and can hide itself or other malicious activity.
- Fileless malware
- Runs mainly in RAM and uses legitimate installed tools, so there may be no obvious malicious file on disk.
Two distinctions get tested a lot. Virus vs worm means user activation versus self-spreading. Trojan vs RAT means deceptive packaging versus deceptive packaging plus remote access. Also, malware labels can overlap. WannaCry was ransomware with worm-like spread.
Common Device Vulnerabilities and How Attacks Work
A vulnerability is a weakness. An exploit is the method or code that takes advantage of that weakness.
- Unpatched software or operating systems let attackers use known flaws.
- Results can include crashes, spying, webcam or mic access, stolen data, or full control.
- Weak authentication means guessable passwords or password-only access.
- Social engineering can steal credentials too.
- Example: a water treatment plant whose embedded pump controllers can be managed remotely with only a username and password, no MFA.
- Once in, the attacker can impersonate the user.
- Unprotected BIOS or UEFI lets someone boot into recovery mode or their own OS from external media.
- They may change passwords, create accounts, or gain elevated privileges.
- Autorun on external drives creates a simple attack chain
- Malware is placed on a drive
- The drive is inserted
- Autorun launches it automatically
- Open ports and exposed services mean something is listening for connections.
- An open port is not automatically bad.
- The risk comes from an unnecessary, insecure, weakly authenticated, or vulnerable service, like Telnet on port 23.
- Missing or misconfigured firewall allows malicious network traffic to reach the device more easily.
- Missing anti-malware removes a layer that could detect or stop installation.
What Device Compromise Can Do and How to Rate Risk
Compromise can lead to unauthorized access, remote control, data theft, impersonation, service disruption, ransom encryption, data wiping, and for embedded systems, physical-world disruption.
The CIA triad helps you classify the harm:
- Confidentiality gets hit by spyware, keyloggers, stolen files, webcam or mic access.
- Integrity gets hit when attackers change data, settings, accounts, or machine commands.
- Availability gets hit by ransomware, crashes, wiped storage, or disabled services.
Risk depends on likelihood + impact.
| Risk level | Typical scenario |
|---|---|
| High | Known critical flaw on an important system, like an unpatched email server |
| Moderate | Real weakness, but exploitation is less certain, like pump controllers with password-only remote access |
| Low | Limited organizational impact, like an employee laptop with Telnet port 23 open |
On quizzes and FRQs, the mistake is rating the vulnerability name by itself. Rate the full scenario. Think asset + weakness + exploit path + likely consequence.
Key Takeaways
Server Computer
A computer that provides one or more services to other computers; server describes a role, though enterprise servers typically have greater capacity than personal computers
Personal Computer
A general-purpose computer designed primarily for one person's work or recreation, such as a desktop, laptop, or notebook
Handheld Computer / Mobile Computer / Information Appliance
A battery-powered computer smaller than a personal computer, such as a smartphone, tablet, or wearable device
Embedded Computer
A computer built into a larger machine to perform specialized functions, usually with limited processing power and storage
Internet of Things (IoT) Device
An everyday or operational product containing an embedded computer, especially one that communicates over a network
Malware
Malicious software that can damage or destroy a device or network or allow an adversary to access a device and its data
Virus
Malware that requires a user to activate it by executing or opening an infected file
Worm
Malware that spreads automatically from one computer to another without human interaction
Trojan
Malware embedded in software that appears harmless or legitimate
Remote Access Trojan (RAT)
A trojan that gives an adversary continuing remote access to and control of the target system
Ransomware
Malware that encrypts files to deny access and demands payment in exchange for a promised decryption key
Spyware
Malware that monitors a user's actions and sends collected information to an adversary
Keylogger
Software or hardware that records a user's keystrokes and provides them to an adversary, often exposing usernames and passwords
Logic Bomb
Malicious code that remains inactive until a specified condition, event, date, or system state triggers its effect
Rootkit
Sophisticated malware with deep operating-system control that can conceal itself, its processes, or an adversary's activity
Fileless Malware
Malicious code that operates in RAM and uses legitimate installed programs instead of relying on a conventional malicious file stored on disk
Vulnerability
A weakness in a device, software, configuration, or control that can be exploited
Threat
Something capable of exploiting a vulnerability and causing harm, such as an adversary or deployed malware
Exploit
A method or code that takes advantage of a vulnerability
Unpatched Software Vulnerability
Exposure caused by failing to install an available patch for a known software flaw, allowing exploits to crash, monitor, alter, or control a device
Weak Authentication
Authentication requirements that make unauthorized access more likely, such as easily guessed passwords or using a password as the only required proof of identity
Unprotected BIOS or UEFI Settings
Basic Input/Output System or Unified Extensible Firmware Interface settings lacking password protection, allowing unauthorized recovery-mode or external-drive booting to gain privileges or alter accounts
Autorun
A feature that automatically executes content when external media is inserted, allowing malware on a drive to run without the user deliberately opening it
Open Port
A network port on which a service is listening for connections; it creates exposure when the reachable service is unnecessary, insecure, or vulnerable
Missing or Misconfigured Firewall
The absence or incorrect configuration of traffic-filtering rules, allowing malicious or unnecessary network data to reach a device or vulnerable service
Missing Anti-Malware Software
The absence of software intended to identify, quarantine, and remove malware, making successful installation or continued operation of malware more likely
Device Risk
The possibility that a device vulnerability will be exploited and the organizational impact if exploitation succeeds
Device Risk Assessment
Evaluating a device vulnerability by considering the asset, plausible threat, likelihood of exploitation, controls, and operational or data impact
Device Risk Documentation
Recording the affected asset, vulnerability, plausible threat or attack, likelihood, impact, and overall risk level
High Device Risk
Risk involving potential compromise of sensitive data or critical operations because exploitation is likely, the impact is severe, or both
Moderate Device Risk
A meaningful device risk, often involving weak authentication or a vulnerability less likely to be exploited, whose likelihood or impact does not support the highest rating
Low Device Risk
A device risk whose successful exploitation would typically have little organizational impact
Notes
Server Computer
A computer that provides one or more services to other computers; server describes a role, though enterprise servers typically have greater capacity than personal computers
Personal Computer
A general-purpose computer designed primarily for one person's work or recreation, such as a desktop, laptop, or notebook
Handheld Computer / Mobile Computer / Information Appliance
A battery-powered computer smaller than a personal computer, such as a smartphone, tablet, or wearable device
Embedded Computer
A computer built into a larger machine to perform specialized functions, usually with limited processing power and storage
Internet of Things (IoT) Device
An everyday or operational product containing an embedded computer, especially one that communicates over a network
Malware
Malicious software that can damage or destroy a device or network or allow an adversary to access a device and its data
Virus
Malware that requires a user to activate it by executing or opening an infected file
Worm
Malware that spreads automatically from one computer to another without human interaction
Trojan
Malware embedded in software that appears harmless or legitimate
Remote Access Trojan (RAT)
A trojan that gives an adversary continuing remote access to and control of the target system
Ransomware
Malware that encrypts files to deny access and demands payment in exchange for a promised decryption key
Spyware
Malware that monitors a user's actions and sends collected information to an adversary
Keylogger
Software or hardware that records a user's keystrokes and provides them to an adversary, often exposing usernames and passwords
Logic Bomb
Malicious code that remains inactive until a specified condition, event, date, or system state triggers its effect
Rootkit
Sophisticated malware with deep operating-system control that can conceal itself, its processes, or an adversary's activity
Fileless Malware
Malicious code that operates in RAM and uses legitimate installed programs instead of relying on a conventional malicious file stored on disk
Vulnerability
A weakness in a device, software, configuration, or control that can be exploited
Threat
Something capable of exploiting a vulnerability and causing harm, such as an adversary or deployed malware
Exploit
A method or code that takes advantage of a vulnerability
Unpatched Software Vulnerability
Exposure caused by failing to install an available patch for a known software flaw, allowing exploits to crash, monitor, alter, or control a device
Weak Authentication
Authentication requirements that make unauthorized access more likely, such as easily guessed passwords or using a password as the only required proof of identity
Unprotected BIOS or UEFI Settings
Basic Input/Output System or Unified Extensible Firmware Interface settings lacking password protection, allowing unauthorized recovery-mode or external-drive booting to gain privileges or alter accounts
Autorun
A feature that automatically executes content when external media is inserted, allowing malware on a drive to run without the user deliberately opening it
Open Port
A network port on which a service is listening for connections; it creates exposure when the reachable service is unnecessary, insecure, or vulnerable
Missing or Misconfigured Firewall
The absence or incorrect configuration of traffic-filtering rules, allowing malicious or unnecessary network data to reach a device or vulnerable service
Missing Anti-Malware Software
The absence of software intended to identify, quarantine, and remove malware, making successful installation or continued operation of malware more likely
Device Risk
The possibility that a device vulnerability will be exploited and the organizational impact if exploitation succeeds
Device Risk Assessment
Evaluating a device vulnerability by considering the asset, plausible threat, likelihood of exploitation, controls, and operational or data impact
Device Risk Documentation
Recording the affected asset, vulnerability, plausible threat or attack, likelihood, impact, and overall risk level
High Device Risk
Risk involving potential compromise of sensitive data or critical operations because exploitation is likely, the impact is severe, or both
Moderate Device Risk
A meaningful device risk, often involving weak authentication or a vulnerability less likely to be exploited, whose likelihood or impact does not support the highest rating
Low Device Risk
A device risk whose successful exploitation would typically have little organizational impact
