Lesson 2.3: The attack surface: every door into a system
What the attack surface is (every way in: open ports, services, accounts, software, people) and the attack vectors that use it, why every unneeded service is a risk, and why cleartext protocols such as Telnet are dangerous. On a server you list what listens on the network, switch off an old Telnet service, move the database so it only listens to the machine itself, and check that the surface really got smaller.
18 min
You will learn to
- Explain attack surface and attack vector
- List the services listening on a server with ss
- Explain why Telnet and other cleartext protocols are risky
- Reduce the attack surface: disable a service and bind another to localhost
- Verify a change instead of assuming it worked
Key terms
- Attack surface
- All the points where an attacker could try to get in or get data out: open ports, running services, user accounts, installed software, web forms, and the people who use them.
- Attack vector
- The specific path or method an attack uses to reach its target.
- Listening service
- A program waiting for network connections on a port. ss -tlnp lists them; 0.0.0.0 means 'on every network card'.
- Cleartext protocol
- A protocol that sends data, including passwords, without encryption, so anyone on the path can read it.
- Hardening
- Reducing a system's attack surface: removing what isn't needed, closing ports, changing risky defaults, applying patches.
- Loopback address (127.0.0.1)
- The address a machine uses to talk to itself. A service bound only to it can't be reached from the network.
← Introduction to the command line · All lessons · Command line arguments and options →