content: Primary attack vectors: 1) Browsers, and specifically, malware served up by ad systems.  It is now quite easy to encode binary code in, for example, every other byte of an otherwise innocuous and functional jpeg image which passes through the browser unchecked, that takes advantage of exploits in the interpreters of those images to execute this code.  This code is usually relatively simple and designed to go out to a site to fetch, extract and execute a bigger malware app that typically becomes part of a bot net that can be controlled remotely. 2) Appliances like storage systems that have exploits in network-based functionality.  Synology and their stupid cloud crap no one asked for is probably the most recent example.  That cost them big.  I did ultimately buy a Synology to replace a big custom RAID I built years ago, but I put a rule on my firewall that blocks all outgoing traffic coming from the Synology.  Even if it gets compromised some other way, it won't be part of a bot net, that is sure.  And yes, I do periodically disable the firewall rule to check for an install software updates on the Synology, but I slam the door closed the second the update is finished. The biggest problem is most general purpose computers were never really designed to be secure at the hardware level, and to build software that is truly secure takes a lot of expertise, time, and money -- all of which are invariably in short supply at companies today because fucking MBA ex-football-jock bean-counter types run the world.