Device Vulnerabilities and Attacks
Every device on a network is a possible door. In this lesson you assess connected farm equipment the way a security analyst would — finding weak points before an adversary does.
Welcome to the FarmGrid Security Lab. AgriNova Farms just connected its tractors, grain silos, irrigation controllers, and weather sensors to the internet so managers can monitor crops from a phone. Productivity went up — but so did the attack surface. Your job is to analyze the risk of these computing devices and recommend defenses.
A device vulnerability is a weakness in a piece of hardware or its software that an adversary can use to cause loss, damage, disruption, or destruction. The same four categories of computing devices show up everywhere — servers, desktops/laptops, mobile devices, and IoT/embedded devices — and each carries its own typical weaknesses.
Know Your Devices
Classify servers, desktops/laptops, mobile, and IoT/embedded devices — because each device type fails in different ways.
Recognize Malware
Match the right malware category — virus, worm, ransomware, spyware, trojan, botnet — to the attack it enables.
Document Risk
Score likelihood and impact, then write a clear risk record an analyst could act on. This is the AP Analyze Risk skill.
- 1Identify types of computing devices (servers, desktops/laptops, mobile, IoT/embedded).
- 2Identify the type of malware used in a cyberattack.
- 3Explain how adversaries exploit common device vulnerabilities to cause loss, damage, disruption, or destruction.
- 4Assess and document risks from device vulnerabilities.
AgriNova's network now includes a data server (stores crop & payroll data), laptops in the farm office, the manager's phone app, and dozens of IoT devices: soil sensors, smart irrigation valves, GPS-guided tractor controllers, and silo temperature monitors. Many shipped with default passwords, run outdated firmware, and expose services straight to the internet. You will inspect them, classify threats, and document the risks.
Big Idea
You cannot defend what you have not inventoried. Securing devices starts with identifying every device, understanding the vulnerabilities each one carries, and documenting the risk so limited resources protect the most important assets first.
By the end you can name the four device categories, map malware to its impact, trace an IoT attack path, score risk with a likelihood×impact lens, and write an analyst-grade risk record — all on a safe, fictional farm network.
Devices, Weaknesses, and How Attacks Unfold
Four device types, a handful of recurring vulnerabilities, and a chain that turns a weak point into damage.
A computing device is any hardware that processes, stores, or transmits data. AP groups them into four families you must be able to identify:
Servers
Centralized machines that store and serve data to many users. High value — one breach exposes everyone.
Desktops / Laptops
Personal workstations. Frequent targets of phishing and trojans because humans use them daily.
Mobile Devices
Phones and tablets that travel, join untrusted Wi-Fi, and mix personal with work data.
IoT / Embedded
Sensors, controllers, cameras. Cheap, rarely patched, often shipped with default credentials.
These devices share a small set of common vulnerabilities. Learn these five — they explain most device attacks on the exam:
- Outdated software / firmware: unpatched code contains known holes adversaries already know how to use.
- Default credentials: factory usernames/passwords (like
admin / admin) that were never changed. - Exposed services: remote-access ports or web panels reachable from the open internet.
- Insecure configuration: unnecessary features on, no encryption, overly broad permissions.
- Malware susceptibility: no antivirus, no monitoring, so malicious code runs undetected.
1.0 and the password admin. Cause: default credential + exposed web panel. Effect: an adversary logs in, installs a botnet agent, and the valve floods a field on command — that's damage and disruption. The fix targets the cause: change the password, restrict the panel, update firmware.
Connected Farm Device Inspector
Select a device to reveal its category, typical vulnerabilities, and why it matters.
Pick a device on the left to inspect its risk profile.
Terms for MCQ and Device Security Analysis
These are the words AP expects you to define precisely and use correctly in free-response analysis.
| Term | Definition | Farm Example |
|---|---|---|
| Computing device | Hardware that processes, stores, or transmits data. | Server, laptop, phone, soil sensor. |
| Attack surface | The total set of points where an adversary could try to enter a system. | Every connected valve adds surface. |
| Vulnerability | A weakness in hardware or software that can be exploited. | Default password on a tractor controller. |
| Exploit | The action or technique that takes advantage of a vulnerability. | Logging in with the unchanged factory password. |
| Default credentials | Factory-set usernames/passwords never changed by the owner. | admin / admin on the silo monitor. |
| Outdated software / firmware | Unpatched code containing known, fixable security holes. | Irrigation firmware v1.0 from 3 years ago. |
| Exposed service | A network service reachable from places it shouldn't be (e.g. the internet). | Remote-management port open to the world. |
| Insecure configuration | Settings that weaken security — extra features on, no encryption. | Web panel with no login required. |
| Malware | Malicious software designed to harm, steal, or take control. | Botnet agent installed on a sensor. |
| Risk | The combination of how likely a threat is and how bad its impact would be. | High-likelihood + high-impact = top priority. |
| Type | What it does | How it spreads / acts |
|---|---|---|
| Virus | Attaches to a file/program and runs when opened. | Needs a user to execute the infected file. |
| Worm | Self-replicates across a network with no user action. | Spreads device-to-device automatically. |
| Trojan | Disguised as legitimate software to trick installation. | User installs it believing it is safe. |
| Ransomware | Encrypts/locks data and demands payment. | Causes loss & disruption until paid/restored. |
| Spyware | Secretly collects data and activity. | Steals credentials, watches usage quietly. |
| Botnet agent | Turns a device into a remotely controlled "zombie." | Many infected IoT devices attack on command. |
What the Exam Wants You to Explain
Skill in focus: Analyze Risk — identify a vulnerability, explain how it could be exploited, and judge the consequence.
A complete AP answer about a device follows three moves: (1) name the specific vulnerability, (2) explain the mechanism — how an adversary uses it, and (3) state the impact in terms of loss, damage, disruption, or destruction. Drop any move and you lose points.
- Confusing a worm (spreads itself) with a virus (needs a user).
- Calling the weakness an "exploit" — the weakness is the vulnerability; the exploit is the action.
- Assuming IoT devices are "too small to matter" — they are prime botnet targets.
- Treating risk as impact only, ignoring likelihood.
When a stem describes "a sensor with the factory password still set, reachable online," it is signaling default credentials + exposed service. The expected answer: an adversary logs in remotely, installs malware, and disrupts operations. Tie every detail in the stem to a vulnerability and an impact.
03:14 login SUCCESS user=
admin from 203.0.113.x (external)03:15 firmware reported:
v1.0 (current release: v3.2)03:16 outbound connection to unknown host :6667
03:18 device joined "coordination" traffic pattern
Read it like AP wants: default admin login from outside = exposed service + default credentials; old firmware = outdated software; the outbound :6667 + coordination pattern = botnet recruitment. Impact: disruption of farm operations and possible pivot to the data server.
Lab: Build & Score an IoT Attack Path
The flagship lab. Reconstruct how an adversary would move through AgriNova's farm network, then read the AP-style reasoning.
An attack path is the ordered set of steps from a weakness to an impact. Reconstructing it is exactly the analysis AP rewards. Build the path below, then check it against the model answer.
Malware Type Classifier
Read each fictional incident and tag the malware category. Instant feedback explains the giveaway.
IoT Attack Path Builder
Click the stages in the order an adversary would use them. Reset and try again any time.
Prompt: "Explain how an adversary could exploit AgriNova's connected devices to cause disruption, and assess the risk."
Model answer: The soil sensor uses default credentials and is reachable from the internet (an exposed service), so an adversary can log in remotely — this is the exploit of the vulnerability. From there they install malware and pivot across the flat network to the irrigation hub and the office laptop, eventually reaching the data server. The impact spans disruption (irrigation offline at harvest) and loss (stolen records).
Risk assessment: likelihood is high (default passwords are trivially guessed and the device is exposed) and impact is high (harvest + data), so overall risk is high — prioritize changing credentials, patching firmware, and segmenting the network.
Misconceptions That Cost AP Points
Recognize the wrong answer and you'll avoid writing it.
× "IoT devices are too small to be a real threat."
Small, unpatched devices are exactly what botnets recruit by the thousands. Their weakness is their value to an adversary.
AP trap: stems that downplay a "tiny sensor" — treat it as a full attack surface.
× "A virus and a worm are the same thing."
A virus needs a user to run an infected file; a worm spreads itself across the network with no user action.
AP trap: "spreads automatically" always points to a worm, not a virus.
× "The vulnerability and the exploit are the same."
The vulnerability is the weakness; the exploit is the action that uses it. AP grades them as separate ideas.
AP trap: name both — "default password (vuln) logged into remotely (exploit)."
× "Risk just means how bad the damage is."
Risk combines likelihood and impact. A catastrophic but near-impossible event can be lower risk than a likely moderate one.
AP trap: always discuss both dimensions when you "assess risk."
× "Antivirus alone secures every device."
Many IoT/embedded devices can't run antivirus. They need patching, credential changes, and segmentation instead.
AP trap: don't apply a laptop fix to a sensor problem.
× "Changing the password fixes everything."
It removes one vulnerability. Outdated firmware and exposed services still remain — defense is layered.
AP trap: a strong answer addresses multiple vulnerabilities, not one.
Vulnerability Reference + Risk Tools
A quick-reference table plus three hands-on tools: a risk board, a documentation builder, and an asset sensitivity sorter.
| Vulnerability | How it's exploited | Possible Impact | Defense |
|---|---|---|---|
| Default credentials | Adversary logs in with factory password. | Full device control | Set unique strong passwords. |
| Outdated firmware | Known published flaw is reused. | Remote takeover | Patch / update regularly. |
| Exposed service | Internet-facing panel is found by scanning. | Unauthorized access | Firewall, close ports, VPN. |
| Insecure configuration | No encryption / extra features abused. | Data interception | Harden settings, least privilege. |
| Malware susceptibility | Malicious code runs undetected. | Loss, botnet, ransomware | Monitoring, segmentation, allow-lists. |
Server
Top risk: high-value data store.
Watch: patching, access control.
Endpoint
Top risk: human-driven (phishing/trojans).
Watch: updates, antivirus, training.
IoT / Embedded
Top risk: default creds, no patching.
Watch: segmentation, credentials.
Device Vulnerability Risk Board
Set likelihood and impact for each device. The board computes a live risk rating (likelihood × impact).
Device Risk Documentation Builder
Fill the fields to generate an analyst-grade risk record — the documenting half of Analyze Risk.
Risk Record
Complete the form and generate a record to see the formatted output here.
Device Asset Sensitivity Sorter
Click an asset, then click the sensitivity bin where it belongs. Items turn green when placed correctly.
Low Sensitivity
Medium Sensitivity
High Sensitivity
Mini AP Quiz + Takeaways
Five quick AP-style questions with instant feedback, then your snapshot for review.
Mini AP-Style Quiz
Choose the best answer. Explanations appear instantly; your score totals at the end.
- 1Four device types — servers, desktops/laptops, mobile, IoT/embedded — each carry distinct vulnerabilities.
- 2Most device attacks trace back to default credentials, outdated software, exposed services, or insecure configuration.
- 3Match malware to its behavior: worms self-spread, trojans disguise, ransomware locks, spyware watches, botnets enslave.
- 4Adversaries exploit weak IoT devices to cause loss, damage, disruption, or destruction — often by pivoting inward.
- 5Risk = likelihood × impact; documenting it directs limited resources to the highest-priority devices.
When asked to analyze device risk, always write the full chain: vulnerability → how it's exploited → impact (loss/damage/disruption/destruction) → likelihood & impact rating. Naming the impact in AP's own four words signals mastery.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.