4.1 Device Vulnerabilities and Attacks

TLDR

Device security starts with knowing what kind of device you are protecting, what malware can do to it, how adversaries break in, and how serious each weakness is. In AP Cybersecurity, you should be able to name device types, identify malware by its behavior, explain common attack openings like unpatched software and weak authentication, and rate a vulnerability as high, moderate, or low risk based on the device's importance.

Why This Matters for the AP Cybersecurity Exam

This topic builds the core adversarial thinking that runs through the whole Securing Devices unit. Once you can identify a device, spot the malware involved, and explain how an attacker would exploit a weakness, you can move on to protecting devices and detecting attacks in later topics.

The exam expects you to do more than memorize definitions. You need to identify malware from a described behavior, explain how a specific vulnerability could be exploited, and assess how risky a situation is given what the device does and what data it holds. Risk assessment in particular is a judgment skill: the same flaw can be high risk on a hospital device and low risk on a break-room printer.

Key Takeaways

• Devices fall into categories with different jobs and weak spots: servers, personal computers, handheld computers, and embedded computers, plus the IoT devices that connect everyday objects to the internet.
• Malware is a tool adversaries use to reach a bigger goal. Learn to identify viruses, worms, trojans (including RATs), ransomware, spyware, keyloggers, logic bombs, rootkits, and fileless malware by how they behave.
• Common attack openings include unpatched software, weak authentication, missing BIOS/UEFI passwords, autorun with external drives, open ports, missing or misconfigured firewalls, and no anti-malware software.
• Risk depends on both how likely a vulnerability is to be exploited and how bad the impact would be, which ties back to the criticality of the device and its data.
• High, moderate, and low risk levels are judgment calls. The same vulnerability can rate differently on different devices.

Types of Computing Devices

Before you can defend a device, you need to know what kind of device you are dealing with. Different categories have different jobs, different power levels, and different weak spots.

Server Computers

Servers are computers that provide services to other computers on a network. Think of them as the helpers that handle requests all day long. Common services include:

• DNS (Domain Name System): translates names like fiveable.me into IP addresses
• DHCP (Dynamic Host Configuration Protocol): hands out IP addresses to devices joining a network
• FTP (File Transfer Protocol): lets users upload and download files

Technically any computer can act as a server. But in a real company, servers usually have more processing power, more RAM, and far more storage than a regular desktop because they are handling requests from many clients at once.

Personal Computers

Personal computers (PCs) are designed for one person at a time. You use them for word processing, gaming, browsing, editing videos, and similar tasks. This category includes desktops, laptops, and notebooks.

Handheld Computers

Handheld computers (also called mobile computers or information appliances) are smaller, run on batteries, and travel with you. Tablets, smartphones, and smartwatches all fall in this group. They have less power than a full PC but they are always with you, which makes them appealing targets for attackers.

Embedded Computers

Embedded computers are built into a machine to control specific parts of it. They run specialized instruction sets made for that machine and they are usually slower, cheaper, and have very little storage compared to a PC. You do not really "use" an embedded computer the way you use a laptop. It runs quietly inside the device.

IoT Devices

When everyday objects with embedded computers connect to the internet, we call them Internet of Things (IoT) devices. They show up in a lot of places:

• Transportation: cars, trains, airplanes
• Critical infrastructure: circuit breakers at electrical substations, pumps at water treatment plants
• Medical equipment: IV pumps, MRI scanners, pacemakers, insulin pumps
• Everyday devices: washing machines, coffee makers, thermostats

Many IoT devices ship with weak default passwords and rarely get patched. A compromised pacemaker or water pump is a much bigger problem than a hacked coffee maker, which is why device criticality matters so much in this topic.

Types of Malware

Malware is malicious software that can damage or harm a device or network, or give an adversary access to a device and the data on it. It is almost always a tool attackers use as one step in a bigger plan. Here are the main types you should be able to identify by behavior.

Viruses

A virus is malware that needs a user to activate it. Someone has to open the infected file, run the program, or click the attachment. No user action, no infection.

Worms

A worm spreads from computer to computer on its own. No clicking required. Once it is on a network, it scans for other vulnerable machines and copies itself over, which is why worms can spread across an entire network quickly.

Trojans

A trojan hides inside software that looks harmless. You think you are downloading a free game or a PDF reader, but malicious code is bundled with it. A specific kind, the [remote access trojan (RAT)](/ap-cybersecurity/key-terms/rat), gives the attacker remote control of your system once it is installed.

Ransomware

Ransomware encrypts the files on a device so the user cannot open them. Then it shows a message demanding payment within a set time, promising a decryption key if you pay. Hospitals, schools, and city governments have all been hit by this, which is an application of the concept, not required AP content.

Spyware and Keyloggers

Spyware quietly tracks what a user does on a computer and sends that information back to the adversary. A keylogger is a specific kind of spy tool (software or hardware) that records every keystroke. Attackers can often extract usernames and passwords from keylogger data.

Logic Bombs

A logic bomb sits dormant until specific conditions are met. The trigger could be a date, a particular OS version, a specific character set, or any other condition the attacker chooses.

Rootkits

A rootkit is some of the most dangerous malware out there. It buries itself deep in the operating system, gives the attacker near-total control, and hides itself from detection tools. Removing one often means wiping the device completely.

Fileless Malware

Most malware lives as a file on disk. Fileless malware is different. It runs in RAM and uses legitimate programs already installed on the device to do its work. Since there is no suspicious file to scan, traditional antivirus often misses it.

How Adversaries Exploit Device Vulnerabilities

Knowing what malware exists is one thing. Understanding how attackers actually get onto a device is what helps you defend it. Here are the most common openings.

Unpatched Software

When a vulnerability in software (including the operating system) becomes known, attackers build an exploit for it. If a device has not installed the patch yet, that exploit works. Depending on the vulnerability, the attacker might:

• Crash the system
• Spy on user actions
• Turn the webcam or microphone on or off
• Take full control and issue any command they want, including stealing or harming data

This is why keeping software updated is repeated so often. Unpatched means exploitable.

Weak Authentication

If passwords are short, common, or reused, attackers can guess them with automated tools. They can also use social engineering (tricking a person into handing over credentials) to skip the guessing entirely. Either way, weak authentication is one of the easiest ways in.

No BIOS/UEFI Password

The BIOS (Basic Input Output System) or UEFI (Unified Extensible Firmware Interface) is the low-level firmware that starts your computer before the OS loads. If there is no password protecting it, an attacker with physical access can:

• Boot the computer into recovery mode for higher privileges
• Boot from their own external drive loaded with a different OS
• Use special tools to create new user profiles or change passwords

Without a BIOS or UEFI password, physical access can give an attacker high-level control.

Autorun and External Drives

If autorun is enabled, plugging in an external drive automatically runs whatever is on it. Attackers can load malware onto a USB drive and count on someone plugging it into a computer, at which point the malware runs.

Open Ports

Every network service uses a port. Open ports that are not needed are like unlocked doors. An attacker who finds an open port can try to connect to whatever service is listening and look for ways to abuse it.

No Firewall or Misconfigured Firewall

A firewall filters network traffic. Without one, or with one that is set up poorly, malicious data sent to the device cannot be filtered out. Attackers can send crafted data to disrupt the device or attempt to take control of it.

No Anti-Malware Software

Devices without anti-malware protection have nothing actively scanning for and blocking known malicious files. That makes them easier targets for malware delivered through email, downloads, or external drives.

Assessing and Documenting Risk

Not every vulnerability is equally dangerous. When you assess risk, you are asking two questions: how likely is this to be exploited, and how bad would it be if it were? The risk level depends on what the device does, what data it holds, and how critical it is.

High Risk

High risks involve potentially compromising sensitive data or critical operations. These are the issues to fix first.

Moderate Risk

Moderate risks come from weaker security practices or from vulnerabilities that are less likely to be exploited but still real.

Low Risk

Low risks are vulnerabilities that, even if exploited, would not cause much harm.

What Risk Actually Looks Like

When you document risk from device vulnerabilities, think about the concrete outcomes an attacker could cause:

• Impersonating an authorized user to access systems they should not
• Remotely controlling a device to spy, pivot to other systems, or cause damage
• Encrypting the drive for ransom (ransomware)
• Wiping memory, harming data or making the device unusable

Match the potential outcome to the value of the device. A compromised insulin pump or substation controller is high risk no matter what. A compromised break-room printer with no sensitive data on it is probably low. The same vulnerability can be high risk on one device and low risk on another, and that judgment call is exactly what this topic asks you to make.

How to Use This on the AP Cybersecurity Exam

Identify the Device First

When a question describes a scenario, name the device type before anything else. A server, a smartphone, an embedded pump controller, and a laptop all carry different stakes. The device type often points you toward how serious a vulnerability is.

Match Malware to Behavior

Most malware questions describe what the malicious software does, not what it is called. Use the behavior as your clue:

• Needs a user to open or run something: virus
• Spreads on its own across a network: worm
• Hidden inside harmless-looking software: trojan (with remote control: RAT)
• Encrypts files and demands payment: ransomware
• Records keystrokes: keylogger
• Tracks activity and reports back: spyware
• Triggers only when conditions are met: logic bomb
• Hides deep in the OS and avoids detection: rootkit
• Runs in RAM using legitimate programs, leaves no file: fileless malware

Connect a Vulnerability to an Exploit

If you are asked to explain how an adversary could exploit a weakness, name the opening and the outcome. For example, unpatched software lets an attacker run a known exploit to take control; no BIOS or UEFI password lets an attacker with physical access boot into recovery mode or load their own OS; open ports give an attacker a service to connect to and abuse.

Justify a Risk Level

When you rate a risk as high, moderate, or low, back it up with two things: how likely the vulnerability is to be exploited and how bad the impact would be given the device's role. Saying "high risk because it is an email server with a known critical patch missing" is stronger than just saying "high risk."

Common Misconceptions

• All malware spreads by itself. Only worms spread without human action. Viruses need a user to open or run something, and trojans rely on someone installing seemingly harmless software.
• A trojan and a virus are the same thing. A trojan is defined by hiding inside something that looks safe. A virus is defined by needing user activation. They can overlap, but the exam tests the defining behavior.
• Antivirus catches everything. Fileless malware runs in RAM and uses legitimate installed programs, so traditional file-scanning antivirus often misses it.
• Any open port is automatically high risk. Risk depends on what is listening on the port and what the device protects. An open telnet port on a laptop with no sensitive data is low risk, while an unpatched email server is high risk.
• IoT and embedded devices are too simple to matter. Embedded systems run critical infrastructure and medical equipment, so a vulnerability there can be among the most serious you will assess.
• Risk is just about the vulnerability. Risk combines likelihood of exploitation with impact, and impact depends on the criticality of the device and the data it holds. The same flaw can be high risk on one device and low risk on another.

Related AP Cybersecurity Guides

• 4.2 Authentication
• 4.3 Protecting Devices
• 4.4 Detecting Attacks on Devices