Image/file/voice-based

1.6 Threat vectors & attack surfaces

📘CompTIA Security+ SY0-701

---

1. Understanding Threat Vectors and Attack Surfaces

Before we get into the types, let’s recall two key ideas:

• Threat vector:
  A path or method used by an attacker to get into a system or network. It’s “how” the attack happens.
• Attack surface:
  The total set of points (systems, applications, users, devices, or data) that attackers can try to exploit.

---

Now we’ll focus on image-based, file-based, and voice-based threats — these are modern and commonly tested vectors in the Security+ SY0-701 exam.

---

2. Image-Based Threat Vectors

Definition

An image-based threat happens when attackers use image files (like .jpg, .png, .gif, etc.) to deliver or hide malicious content.

Images seem harmless, but they can be manipulated to carry malware, scripts, or hidden code that executes when the file is opened or processed by vulnerable software.

---

How Image-Based Attacks Work

1. Steganography (Hidden Data in Images):
   • Attackers hide malicious code or secret messages inside image pixels or metadata.
   • Tools can extract and execute the hidden code later.
   • Example (IT-based): Malware command instructions hidden inside a .png file downloaded from a website.
2. Image Parsing Vulnerabilities:
   • When image files are uploaded or opened, the system uses an image parser (part of the OS or app).
   • If the parser has a vulnerability, attackers can exploit it to execute code.
   • Example: A vulnerable web server that allows users to upload profile pictures could be attacked with a specially crafted .jpg that triggers remote code execution.
3. Phishing via Images:
   • Attackers create image-only emails that look like text, tricking filters and users.
   • When clicked, they redirect users to fake login pages or malicious downloads.

---

Security Measures Against Image-Based Threats

• Use content filters to scan images for malware.
• Disable automatic image loading in emails.
• Keep image processing libraries and web servers patched.
• Use security gateways that inspect image content.
• Implement file integrity monitoring to detect unauthorized changes.

---

3. File-Based Threat Vectors

Definition

A file-based attack occurs when attackers use a normal-looking file (like Word documents, PDFs, spreadsheets, ZIP files, or executables) to carry malicious code.

This is one of the most common threat vectors in enterprise environments.

---

How File-Based Attacks Work

1. Malicious Attachments:
   • Attackers send infected files through email or instant messaging.
   • When users open them, scripts or macros inside execute malicious actions (like downloading malware or stealing credentials).
2. Macro-Based Attacks:
   • Microsoft Office documents (e.g., .docm, .xlsm) can include macros — small programs written in VBA.
   • Attackers enable these macros to run automatically and compromise systems.
3. Exploiting File Format Vulnerabilities:
   • Attackers create malformed or specially crafted files that exploit vulnerabilities in the software used to open them.
   • Example: A malicious PDF exploiting an outdated version of Adobe Reader.
4. Executable File Delivery (.exe, .bat, .dll):
   • Attackers disguise malware as legitimate software or drivers.
   • If executed, it installs backdoors, ransomware, or keyloggers.
5. Compressed Files (ZIP, RAR):
   • Used to hide malicious files or bypass security filters.
   • Attackers use password-protected archives to prevent antivirus from scanning inside.

---

Security Measures Against File-Based Threats

• Disable macros by default in Office files.
• Use sandboxing — open unknown files in isolated environments.
• Use anti-malware scanners with real-time file inspection.
• Educate users to avoid opening unexpected attachments.
• Implement file-type filtering at email and web gateways.
• Keep applications updated to patch file parsing vulnerabilities.

---

4. Voice-Based Threat Vectors

Definition

A voice-based threat happens when attackers use voice communication channels — like phone calls, voicemail, or voice assistants — to deceive or collect information.

This category focuses more on social engineering through voice and AI-driven impersonation (voice deepfakes).

---

How Voice-Based Attacks Work

1. Vishing (Voice Phishing):
   • Attackers call targets pretending to be from a trusted organization (IT support, bank, etc.).
   • The goal is to get sensitive information like passwords, MFA codes, or financial details.
2. Voice Deepfakes (AI-generated Voice):
   • Attackers use AI tools to clone voices of real people (such as executives or managers).
   • They can leave urgent voicemails or make calls requesting money transfers or sensitive access.
3. VoIP Exploitation:
   • Attacks targeting Voice over IP systems (like softphones or IP PBXs).
   • Techniques include:
     • Caller ID spoofing (faking identity),
     • VoIP phishing,
     • or exploiting VoIP protocol vulnerabilities (like SIP attacks).
4. Voice Assistant Exploits:
   • Attackers may try to activate smart assistants (like Alexa, Siri, or Google Assistant) using voice commands to leak data or perform actions.

---

Security Measures Against Voice-Based Threats

• Train employees to verify voice requests using known channels (not callback numbers given in calls).
• Use caller verification systems and call filtering.
• Protect VoIP systems with strong authentication and updated firmware.
• Monitor for unusual voice traffic patterns.
• Implement policies for verbal authorization (e.g., no transactions by voice alone).

---

5. Summary Table

Threat Vector Type	Description	Common Attack Methods	Key Protections
Image-Based	Attacks hidden in image files	Steganography, image parsing exploit, phishing images	Patch software, scan images, restrict uploads
File-Based	Malicious code inside or disguised as files	Macro malware, PDF exploits, fake executables	Disable macros, sandboxing, scan attachments
Voice-Based	Social engineering through voice	Vishing, AI deepfakes, VoIP spoofing	Caller verification, VoIP hardening, employee training

---

6. Exam Tips (SY0-701)

✅ Understand that each vector uses a different medium (image, file, or voice) but the goal is always to deliver malware or steal data.
✅ Recognize keywords:

• Image → “steganography,” “malformed image,” “photo upload.”
• File → “macro,” “attachment,” “malicious PDF.”
• Voice → “vishing,” “deepfake,” “VoIP.”
  ✅ Know prevention techniques: security awareness, content scanning, patching, and verification processes.
  ✅ Remember: Voice-based = social engineering, Image/File-based = technical delivery.

---