Attackers scan a forgotten facilities camera server and find RDP listening on the internet. What is the attack surface?
Select an answer to reveal the explanation.
Short Explanation
That leftover camera box is sitting on the internet with RDP wide open—like leaving the loading-dock keypad on a public sidewalk. The attack surface is the exposed management interface. Mail rules and USB drops are different doors.
Full Explanation
Attackers scanning a forgotten facilities camera server and finding RDP listening on the internet are looking at an internet-exposed remote-desktop management interface as the attack surface. The leftover camera box sits on the public sidewalk of the internet with remote desktop open for anyone who finds it. Civic facilities IoT and leftover servers frequently create this surface after projects end; mail rules and USB drops are different doors that this stem does not describe.
Calling it a hidden mailbox forwarding rule fails by concept: email persistence is not the exposed network surface described by internet-facing RDP. Calling it a public permits API injection flaw fails by concept: the stem is remote desktop on a camera server, not SQL-style injection against a permits API. Calling it a library USB drop fails by concept: physical media is not involved in discovering internet-exposed RDP on a facilities host.
Exam caveat: Internet-facing RDP or management services on forgotten devices equal an exposed remote-desktop management attack surface.
Operational check: Remove public RDP exposure immediately, place cameras behind managed access paths, inventory all facilities IoT management ports, and add Enterprise Security detections for internet RDP authentication attempts against civic ranges.