問73
頻出度★★★
ボットの説明はどれか。
平成21年度 秋期 ITパスポート試験 問73
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 73
Incorrectア
This describes “one-click fraud”. It is a scam that claims a contract has been formed merely because the user viewed a website or clicked an image, and then demands payment. It is not a program that remotely controls a PC.
Incorrectイ
This describes a “rootkit”. It is a mechanism that packages and hides tools such as log erasers and backdoors so the attacker can re-enter the system and conceal traces of the intrusion. It lacks the element of launching simultaneous attacks under remote instructions.
- ウ
正解 A bot is malware that infects many PCs and remotely controls them through instructions sent over a network. An infected PC is taken over by the bot and waits for orders from a command-and-control (C&C) server prepared by the attacker; once an order arrives, the infected PCs simultaneously carry out actions such as DDoS attacks or mass sending of spam mail. The collection of such infected PCs is called a botnet. Choice “ウ” is the correct description of a bot because it contains all three elements: “infects many PCs”, “illicitly controls them according to instructions sent over a network”, and “simultaneous attack”.
Incorrectエ
This describes “spyware”. It is a program installed against the user's intent that collects personal information and browsing history and sends it outside. Its purpose is stealing information, not remotely controlling a PC to make it take part in attacks.
ここがポイント
- Bot: malware that remotely controls infected PCs using instructions from a command-and-control (C&C) server. The group of infected PCs is called a botnet and is used as a stepping stone for DDoS attacks and mass spam mailing.
- Distinguish confusable malware terms: rootkit (hiding traces of intrusion and stashing backdoors), spyware (collecting information without permission), and one-click fraud (a scheme for unjustified billing). Remember each by its purpose.
用語