問87
頻出度★★★
フィッシングの説明として, 最も適切なものはどれか。
平成23年度 秋期 ITパスポート試験 問87
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 87
Incorrectア
This describes a bot (botnet). A PC infected with a bot secretly communicates with the attacker's command server and is remotely operated from outside, being used to send large volumes of spam or as a stepping stone for attacks on other sites. This description assumes that malware infection has already succeeded, and what is at issue is operating the infected device itself from outside. Phishing, by contrast, works regardless of whether the user's PC is infected, and what is stolen is not control of the device but information the user entered themselves. The starting point and the target taken are both different.
- イ
正解 Phishing is a technique in which the attacker impersonates a real bank, credit card company, or online shopping site, sends fake e-mails or text messages, uses a link in the message to lure the recipient to a fake website, and has the user type in important information such as user IDs, passwords, and credit card numbers with their own hands, thereby stealing it. There are two key points. First, it starts with luring the victim through a fake message. Second, the information is not taken by breaking into equipment; the user is made to believe a screen that looks just like the real one and enters the data themselves, so it is a technique that exploits human psychology. The destination may be a fictitious site that does not exist at all, or a fake site that copies the screens of a legitimate site exactly. Choice イ states “sending fake e-mails or the like”, “luring recipients to a fictitious website or a fake site impersonating an existing website”, and “illegally obtaining information” — exactly this flow of luring and stealing, which matches the definition of phishing completely. Therefore the most appropriate description is イ.
Incorrectウ
This describes cross-site scripting (XSS). On a web page that displays a string entered by a user directly in the browser, such as a message board or a search result page, if the sanitizing of the input is insufficient, a script planted by the attacker runs in the browsers of other visitors and information such as cookies is stolen. This is a technical attack that exploits a vulnerability in a program on the legitimate website side, not a technique of building a fake site and luring users into it. The decisive difference is that phishing works even when the legitimate site has no vulnerability.
Incorrectエ
This describes spyware (including keyloggers). It resides on a PC without the user noticing, collects the contents of stored files as well as keyboard input and records of PC operations, and sends them outside. The goal of stealing information is the same as in phishing, but the means differ. Spyware makes an unauthorized program stay inside the PC and siphons information out, whereas phishing plants nothing on the PC and instead deceives the user with fake e-mails and fake sites so that the user enters the data themselves. The very fact that it presupposes a resident program means it cannot be a description of phishing.
ここがポイント
- Definition of phishing: a technique that sends fake e-mails and the like impersonating a real organization, lures users to a fictitious website or a fake site that imitates a legitimate one, and has the person themselves enter information such as IDs, passwords, and credit card numbers so that it can be stolen. Its essence is that it is not a technical intrusion but a social-engineering attack that deceives people.
- Distinguishing confusable attack techniques: remotely operating an infected PC from outside is a bot; exploiting a vulnerability in a function that displays input in order to steal the information of other visitors is cross-site scripting; residing on a PC to collect and send out information is spyware. In addition, the technique of rewriting DNS information so that a user who entered the correct URL is led to a fake site is called pharming, which should be learned as distinct from phishing.
用語