問75
頻出度★★★
情報セキュリティの脅威であるキーロガーの説明として, 適切なものはどれか。
平成23年度 特別試験 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 75
Incorrectア
Stealing information by looking from behind a PC user at the keyboard input and the display is a description of shoulder hacking (also called shoulder surfing). It relies only on human eyesight, the attacker's own eyes, so it is a physical, analog technique that needs no program running on the PC and no recording device at all, and that is where it differs from a keylogger. Its countermeasures are also mainly physical precautions, such as fitting a privacy filter, arranging which way the screen faces, and checking the surroundings when entering a password. It is therefore not a description of a keylogger and is incorrect.
- イ
正解 The correct answer is イ. A keylogger, as its name suggests, is a mechanism that logs (records) keys (keyboard input): it secretly records what the user types on the user's own PC, and the attacker later obtains those records to steal information such as IDs, passwords, credit card numbers, and the text of e-mails. Choice イ says exactly that a mechanism for recording keyboard input is run on the user's PC and those records are obtained, which matches this definition directly. There are broadly two forms of keylogger. One is the software type, which gets into the PC and stays resident there as malicious software such as spyware or a Trojan horse, and writes the typed content to a file or sends it to the attacker. The other is the hardware type, a small recording device inserted at the connection between the PC itself and the keyboard, which physically stores the typed content so that it can be collected later. The software type is basically prevented by installing security software and keeping its definition files up to date, and by updating the OS and applications; the hardware type cannot be detected by software, so physical management, such as visually checking the connector when using a shared PC or a terminal at an Internet cafe, is the countermeasure. In addition, a software keyboard that avoids actual keystrokes (a method of typing by clicking an on-screen keyboard with the mouse), as well as one-time passwords and multi-factor authentication, are effective ways to prevent misuse of information stolen by a keylogger. For these reasons, the appropriate description of a keylogger is イ.
Incorrectウ
Analyzing passwords using dictionary data that covers words likely to be used as passwords is a description of a dictionary attack. This is a form of password cracking in which the attacker tries candidate strings one after another in order to break through authentication; it does not record what the user types. The two do share the goal of obtaining a password, but a keylogger steals the genuine password that the person actually entered, whereas a dictionary attack guesses the password and hits on it, so the mechanisms are completely different. Countermeasures against a dictionary attack are the use of complex passwords that avoid words listed in dictionaries, and account lockout, which are a different matter from countermeasures against keyloggers. It is therefore incorrect.
Incorrectエ
Moving around town carrying a PC that can detect wireless LAN signals in order to find access points that can be used illegitimately is a description of wardriving. It is the act of searching from outside for wireless LAN access points that are unencrypted or inadequately configured; its target is the radio signal of a wireless network, not keyboard input. Countermeasures include encrypting the wireless LAN with WPA2 or WPA3, managing equipment so that the default settings are not left as they are, and configuring access control. It has nothing to do with recording keyboard input, so it is incorrect.
ここがポイント
- Definition of a keylogger - a threat in which what the user types is recorded on the PC side and an attacker obtains that record to steal information such as IDs and passwords. There is a software type (resident as spyware or a Trojan horse) and a hardware type (a recording device inserted at the keyboard connector); the latter cannot be detected by security software, so physical management such as visually checking the connector is needed.
- Telling similar threats apart - looking from behind is shoulder hacking, guessing passwords with dictionary data is a dictionary attack, and going around searching for wireless LAN signals is wardriving. A keylogger is distinguished from these by stealing the genuine information the person actually entered, by means of a record made on the PC.
用語