問75
頻出度★★★
銀行やクレジットカード会社などを装った偽のWebページを開設し,金融機関や公的機関などを装った偽の電子メールなどで,利用者を巧みに誘導して,暗証番号やクレジットカード番号などの個人情報を盗み取る行為を何と呼ぶか。
平成22年度 秋期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 75
Incorrectア
Cracking is a general term for illegally breaking into someone else's computer or network and carrying out malicious acts such as eavesdropping on, altering, or destroying data. It centers on technical attacks such as exploiting system vulnerabilities or breaking through authentication, so it is not the word that specifically describes this question's method of getting users themselves to enter personal information through a fake site and a fake email.
Incorrectイ
A buffer overflow is an attack technique in which more data than a program's prepared memory area (the buffer) can hold is sent in, so that the overflowing part destroys the adjacent area and an unauthorized program is executed. It is a technical attack that exploits a vulnerability in the program's implementation, and it has nothing to do with a fraudulent technique that lures users to a fake site.
- ウ
正解 The correct answer is ウ, phishing. Phishing is the act of sending fake emails or SMS messages that impersonate real banks, credit card companies, financial institutions, or public agencies, luring users to fake web pages (phishing sites) built to look just like the genuine ones, having the users themselves enter personal information such as PINs, passwords, and credit card numbers, and then stealing that information. The four points in the question, namely the fake web pages that impersonate a company, the fake emails that impersonate an organization, cleverly luring the user, and stealing personal information, all correspond directly to the typical elements of phishing. Its biggest characteristic is that it does not break the system technically; instead it exploits the psychological side, the trust and assumptions of the user (a social engineering technique).
Incorrectエ
A bot is a malicious program (malware) that lets an infected computer be operated remotely from an external command server. Large numbers of infected machines form a botnet and are used as a springboard for sending huge volumes of spam or for DDoS attacks. It is a type of malware, and it is not a term for the act itself of stealing personal information with fake web pages and fake emails.
ここがポイント
- Phishing = a technique that impersonates a real organization, uses fake emails plus fake websites to lure users, and gets the users themselves to enter personal information such as PINs and credit card numbers so that it can be stolen. Remember that it is a social engineering type of attack that exploits human psychology.
- Security terms are easier to tell apart if you sort them into three groups: those that attack a system technically (cracking, buffer overflow), those that deceive the user (phishing, one-click fraud), and the malicious programs themselves (bots, viruses, worms).
用語