1.6 Threat vectors & attack surfaces
📘CompTIA Security+ SY0-701
🔍 Overview
An unsecure network is any network that lacks proper security controls, making it easier for attackers to intercept, manipulate, or access data and devices.
Networks connect computers, servers, mobile devices, and other systems — so if these connections are not properly protected, they become a major attack vector (a pathway for attackers to exploit).
Attackers can use these insecure networks to:
- Steal sensitive data (like credentials or confidential information)
- Launch attacks such as Man-in-the-Middle (MitM), packet sniffing, or spoofing
- Gain unauthorized access to systems
- Disrupt services
⚙️ 1. Wireless Networks (Wi-Fi)
Wireless networks are convenient but highly vulnerable if not secured properly.
🔸 Common Wireless Security Risks
- Open Wi-Fi Networks
- Networks with no encryption (e.g., open guest Wi-Fi).
- Attackers can eavesdrop on all traffic using packet capture tools.
- They can intercept usernames, passwords, or session tokens.
- Weak Encryption
- Using outdated security protocols like WEP or WPA.
- These can be easily cracked using freely available tools.
- Modern standard: WPA3 (or at least WPA2 with strong password).
- Rogue Access Points (APs)
- Unauthorized APs set up by attackers to trick users into connecting.
- Once connected, attackers can monitor or modify traffic.
- Often used in Evil Twin Attacks, where the fake AP mimics a real network name (SSID).
- Default Configurations
- Many routers and wireless controllers come with default admin passwords or open management interfaces.
- Attackers can log in and change configurations or capture network data.
- SSID Broadcasting
- Broadcasting the network name (SSID) allows anyone nearby to see it.
- Disabling SSID broadcast is not full protection, but helps reduce casual visibility.
- Weak Authentication
- Using shared passwords (like one password for all employees).
- This makes it difficult to track or revoke individual access.
- Wireless Sniffing / Eavesdropping
- Attackers use wireless sniffing tools (like Wireshark in monitor mode) to capture data frames in unencrypted networks.
✅ Security Best Practices for Wireless Networks
- Use WPA3 (or WPA2-Enterprise) with 802.1X authentication and RADIUS.
- Use strong passphrases.
- Disable SSID broadcasting (optional minor layer).
- Disable WPS (Wi-Fi Protected Setup), which is easily exploitable.
- Regularly update wireless firmware.
- Segment guest Wi-Fi from internal networks.
- Implement Network Access Control (NAC) to verify devices before connecting.
⚙️ 2. Wired Networks (Ethernet/LAN)
People often think wired networks are secure, but they can still be exploited if not protected. Attackers who gain physical access or connect a malicious device to a switch or wall port can attack the internal network.
🔸 Common Wired Security Risks
- Unsecured Network Ports
- Open network ports in meeting rooms or public areas can be exploited by plugging in unauthorized devices.
- Attackers can use these to connect laptops or network sniffers.
- Lack of Network Segmentation
- Without segmentation, all devices share the same network.
- If one system is compromised, attackers can move laterally to others.
- ARP Spoofing / Poisoning
- Attackers send fake ARP messages to associate their MAC address with another device’s IP (like the gateway).
- This allows interception or redirection of traffic.
- MAC Flooding
- Attackers flood a switch with many fake MAC addresses, forcing it to act like a hub, which broadcasts all traffic, making it easy to sniff.
- Physical Security
- If servers, switches, or routers are in unlocked or public areas, attackers can connect devices or reset configurations.
- Unmonitored Network Devices
- Old or unmanaged switches, routers, or IP phones may have default credentials or outdated firmware.
✅ Security Best Practices for Wired Networks
- Disable unused ports on switches.
- Use Port Security (limit MAC addresses per port).
- Implement 802.1X authentication to verify devices.
- Use VLANs to separate departments or sensitive data zones.
- Secure all network equipment in locked rooms or racks.
- Regularly update switch/router firmware.
- Monitor for rogue devices using network management tools.
⚙️ 3. Bluetooth Networks
Bluetooth connects devices such as headsets, keyboards, mobile devices, and IoT devices. Though designed for short-range communication, it can still be exploited.
🔸 Common Bluetooth Security Risks
- Unsecured Pairing / Default PINs
- Devices with simple PINs like “0000” or “1234” can be easily guessed.
- Attackers nearby can pair and gain access to data.
- Bluetooth Sniffing
- Attackers use Bluetooth sniffing tools to capture data or metadata transmitted between devices.
- Bluejacking
- Sending unwanted messages to Bluetooth-enabled devices.
- Mostly a nuisance but shows exposure to unauthorized communication.
- Bluesnarfing
- Exploiting vulnerabilities to steal data (like contacts, messages, or files) from Bluetooth-enabled devices.
- Bluebugging
- Advanced attack where attackers gain full control of a device via Bluetooth.
- Leaving Bluetooth Always On
- Increases exposure window for attackers to detect and target the device.
✅ Security Best Practices for Bluetooth Networks
- Disable Bluetooth when not in use.
- Use non-discoverable mode to hide the device.
- Avoid default or weak PINs.
- Keep Bluetooth firmware updated.
- Use authentication and encryption during pairing.
- Regularly remove old or unused paired devices.
⚠️ Summary Table
| Network Type | Common Risks | Key Protections |
|---|---|---|
| Wireless (Wi-Fi) | Open networks, weak encryption, rogue APs, sniffing | Use WPA3, strong passwords, disable WPS, segment guest Wi-Fi |
| Wired (LAN) | Open ports, ARP spoofing, MAC flooding, poor segmentation | Port security, VLANs, 802.1X, lock equipment |
| Bluetooth | Weak PINs, discoverable mode, sniffing, Bluejacking | Disable when not needed, use encryption, hide device, update firmware |
💡 Exam Tips
- Remember that “unsecure networks” are attack vectors — pathways attackers use.
- Know common attacks (ARP poisoning, rogue APs, Bluejacking).
- Know security protocols and protections (WPA3, 802.1X, VLANs).
- Identify which type of network is at risk in exam questions.
- Example: “An attacker nearby intercepts Wi-Fi traffic” → Wireless
- Example: “Attacker plugs into unused Ethernet port” → Wired
- Example: “Attacker sends unwanted messages to phones” → Bluetooth
🧩 Final Summary
Unsecure networks — whether wireless, wired, or Bluetooth — represent serious attack vectors in any organization.
The main goal of network security is to control access, encrypt communications, limit exposure, and monitor activity so that attackers cannot exploit these connections.
