Message, voice and file-based vectors, and the social engineering behind them

Objective 2.2 in this course covers threat vectors and attack surfaces — CompTIA's scope note for it explains message-based, unsecure networks, social engineering, file-based, voice call, supply chain and vulnerable software vectors. This lesson takes the human-facing half; networks, supply chain and software are the next lesson.

Why this matters

The overwhelming majority of real intrusions begin with a person being persuaded to do something. Not with an exploit, not with a firewall misconfiguration — with an email, a text, or a phone call. The exam reflects that: social engineering terms appear throughout Domain 2 and reappear in Domain 4's awareness material.

The terminology is the marks. There are a dozen named techniques, the distinctions between them are genuinely precise, and the questions are usually "which technique is this?" given a two-sentence scenario.

The lesson

Email, SMS and instant messaging as the vector, phishing as the technique

Keep the two ideas separate, because CompTIA does.

The vector is the route in: email, SMS, instant message, a voice call, a file, a removable device, a website. The technique is what is done with it: persuasion, a malicious attachment, a credential harvesting page.

Phishing is the technique of sending a fraudulent message to get someone to reveal information, click something, or take an action. Its named variants:

• Spear phishing — targeted at a specific person or small group, using details about them. Far higher success rate.
• Whaling — spear phishing aimed at senior executives, who have the authority to approve payments and the least time to be careful.

The signals of phishing worth teaching users are: urgency, an unexpected request, a mismatch between display name and actual address, a link whose target differs from its text, a request to break a normal process, and unusual payment or credential requests. Note that spelling errors are a weak signal now and a poor thing to train people on.

Smishing is phishing by SMS. It works disproportionately well because phones show truncated links, people read texts in seconds, and SMS carries a residual sense of legitimacy from bank alerts.

Vishing, smishing, and the voice call that defeats an otherwise good control

Vishing is phishing by voice call. It is the vector most likely to defeat controls that look strong on paper, because a live human can adapt.

The scenario the exam likes: an organisation has deployed multifactor authentication. An attacker with a stolen password calls the user, claims to be IT investigating suspicious activity, and asks them to read out the code they are about to receive — or simply triggers repeated push notifications until the user approves one to stop the noise. That last technique is MFA fatigue or push bombing, and it is why number matching exists (Domain 4).

Vishing also targets the help desk, which is a control gap in most organisations: a caller who knows an employee's name, manager and start date can often get a password reset. The defence is a defined identity verification procedure for resets that does not rely on facts an attacker can look up.

Modern variants use synthesised voice to impersonate a specific person. The control that survives this is process, not recognition — call-backs to a known number, and dual authorisation for payment changes.

Pretexting, impersonation, business email compromise and watering hole

• Pretexting is inventing a scenario that gives the attacker a reason to be asking. "I'm from the audit team and I need to verify a few account details before Friday." The pretext is the story; it is the foundation most other techniques are built on.
• Impersonation is claiming to be a specific person or role — the CEO, a supplier, a police officer, an IT technician.
• Business email compromise (BEC) is the high-value case: an attacker gains access to, or convincingly spoofs, a genuine business mailbox, then uses the existing conversation to redirect a payment. There may be no malware at all, which is why it defeats controls aimed at attachments. The control is a process one: verify bank detail changes out of band, every time.
• A watering hole attack compromises a site the target group is known to visit — an industry forum, a local news site, a supplier's portal — and waits. It is indirect: the attacker never contacts the victim. The exam tell is "a site the employees commonly use was compromised".

Two more CompTIA names here: brand impersonation, using a trusted organisation's identity and look, and typosquatting, registering domains that are near-misses of a real one (exmaple.com, example.co) to catch typing errors and to make phishing links look right at a glance.

Typosquatting, brand impersonation, misinformation and disinformation

Misinformation is false information spread without intent to deceive; disinformation is false information spread deliberately. CompTIA lists them as an attack vector because influence campaigns are a security concern for organisations: fabricated claims about a product, a forged press release moving a share price, a coordinated campaign damaging a brand ahead of a contract award.

The defence is not technical. It is monitoring for brand mentions and impersonating domains, having a communications plan that can respond quickly, and registering the obvious typosquat domains yourself so they cannot be used against you.

Image and removable-device vectors, and why 'found USB' still works

File-based vectors are files that carry the payload: a macro-enabled document, a PDF with an embedded script, an ISO or archive that bypasses the mark-of-the-web tagging that would otherwise warn the user, a shortcut file disguised as a document. The generic control is a combination of blocking risky file types at the gateway, disabling macros from the internet by policy, and sandbox detonation — all Domain 4 material.

Image-based vectors are files whose format parser is the target, or which carry data steganographically. They are rarer and worth knowing chiefly as a category.

Removable devices remain effective, and the exam still tests it. A USB drive left in a car park or posted to an employee works for two reasons: curiosity, and the fact that a device can present itself as something other than storage. A "USB drive" can enumerate as a keyboard and type commands the moment it is plugged in, which defeats any control aimed at files on the device.

The controls: disable autorun, restrict or block removable storage by policy, allow only approved encrypted devices, and — the one that actually addresses the keyboard case — device control that blocks unapproved HID devices. Awareness training helps and does not solve it, because the failure only has to happen once.

What to take into the exam

• Vector is the route; technique is what is done with it. Questions often give you one and ask for the other.
• Spear phishing is targeted, whaling targets executives, smishing is SMS, vishing is voice.
• BEC redirects a payment using a real or convincingly spoofed business mailbox, often with no malware, and is beaten by out-of-band verification.
• Watering hole means the site the victims visit was compromised, not the victims.
• Misinformation is unintentional, disinformation is deliberate.
• A malicious USB may act as a keyboard, which is why file-level controls do not cover it.