問87
頻出度★★★
攻撃者が，システムの利用者になりすましてシステム管理者に電話をかけ，パスワードを忘れたと言ってパスワードを初期化してもらい，システムに侵入した。このような行為を何というか。
平成22年度 春期 ITパスポート試験 問87
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 87
Incorrectア
A DoS attack (Denial of Service) sends a server a huge volume of requests or malformed packets to overload it and stop or disrupt the service. Its aim is to take away the availability of the service, not to obtain a password and break into the system as in this question.
Incorrectイ
A brute-force attack is a technical attack that mechanically tries every conceivable password combination one after another until it finds the right one. The attacker in this question did not try any passwords; he had the administrator reset the password and received it, so this does not apply.
- ウ
正解 Social engineering is the general term for improperly obtaining important information such as passwords, or obtaining privileges, by exploiting gaps in human psychology or laxness in an organization's operational procedures rather than technical weaknesses of computers or networks. In this question the attacker (1) impersonated a legitimate user and made a phone call, (2) used the natural excuse of “having forgotten the password” to take advantage of the administrator's goodwill, and (3) had the password reset without sufficient identity verification, thereby obtaining the password. The decisive point is that no program was analyzed and no encryption was broken; the only thing the attacker dealt with was a “person”. Therefore the correct answer is ウ, social engineering. Note that the countermeasures are also operational rather than technical: rules such as not allowing password resets over the phone and defining identity verification procedures, together with employee education, are effective.
Incorrectエ
A backdoor is an unauthorized entrance planted in a system, typically by an attacker who has already broken in, so that he can get back in later without going through the legitimate authentication. This question is about obtaining information by deception over the phone, not about planting a hidden entrance in a system.
ここがポイント
- Social engineering = a technique that steals information by exploiting gaps in “people” rather than in technology (impersonation phone calls, shoulder surfing, dumpster diving, and so on). Its countermeasures are mainly operational, such as strictly enforcing identity verification procedures and training employees.
- Organize attack techniques by what they target. DoS attack = a load-based attack aimed at availability; brute-force attack = mechanically trying passwords; backdoor = a hidden entrance left behind for getting back in. Only a technique that deceives people, like the one in this question, falls into a different category.
用語