A small company's logs show a successful administrator login to its internet-facing server at 3 a.m. from an address in another country, following three days of failed attempts against the same account. No one phished anyone and no attachment was opened. The company had exposed Remote Desktop to the internet, and an attacker simply knocked on that door until a guessed password let them in.
This lesson covers the vectors that target infrastructure and the machines on it rather than the user's inbox. On the CompTIA Security+ SY0-801 exam, objective 2.3 groups these as network-based vectors (infrastructure devices, virtualized devices and session keys), remote-access vectors (Remote Desktop, VNC and VPN), and endpoint-based vectors (workstations, servers, mobile devices, tablets, trusted devices, built-in tools and living-off-the-land tools). For each, this lesson explains how it is used, what it looks like, and the primary defense. The malware and the network attacks that follow once an attacker is in are later sections; here the subject is the way in.
Infrastructure devices are valuable because they sit in the traffic path
Infrastructure devices are the routers, switches, firewalls, load balancers and wireless controllers that move and control traffic. They are an attractive vector for a reason that is easy to overlook: they sit directly in the path of everything, so an attacker who controls one can watch, redirect, or block all traffic passing through it. They also tend to be forgotten. Organizations patch servers and laptops diligently and leave the network gear on firmware that shipped years ago.
An attacker reaches these devices in a few ways. A management interface left exposed to the internet invites direct attack. Default or unchanged administrative credentials let an attacker log straight in. And unpatched firmware with published vulnerabilities can be exploited remotely, which is a favorite of advanced adversaries because a compromised firewall or router rarely runs endpoint protection and is seldom inspected. What it looks like is often nothing at the endpoint level, because the compromise is below where most monitoring watches.
The defenses are patching firmware on a real schedule, changing default credentials, moving management interfaces off the internet and onto an isolated management network, disabling unused services, and monitoring the devices' own logs. On the exam, an unpatched or default-credentialed router, switch or firewall, especially an internet-facing one, is the infrastructure-device vector.
Virtualized devices and stolen session keys extend the reach
Modern infrastructure is largely virtual, and that adds two items the objective lists. Virtualized devices are virtual machines, virtual switches, virtual firewalls and the hypervisor that hosts them. They carry the same risks as physical gear, an unpatched virtual appliance is as exploitable as a physical one, plus risks of their own. The most serious is a virtual-machine escape, where an attacker breaks out of a guest VM to the hypervisor and so reaches every other VM on that host. A compromised management console for the virtual environment is similarly dangerous, because it controls many systems at once. Virtual appliances also multiply quickly and can be spun up and forgotten, each one an unpatched surface.