問76
頻出度★★★
多数のコンピュータに感染し, 遠隔操作で攻撃者から指令を受けると DDoS 攻撃などを一斉に行う不正プログラムに付けられた呼び名はどれか。
平成23年度 特別試験 ITパスポート試験 問76
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 76
Incorrectア
A honeypot is not a malicious program but a decoy system set up by the defending side. A server or network is deliberately made to look vulnerable in order to lure attackers in, so that their intrusion techniques, samples of the malware they use, and information about where the attack comes from can be observed and collected and then used for protecting the real systems and analysing damage. It is not something that gets infected and receives commands from an attacker, but a mechanism on the defender's side for observing attacks, so its role is the exact opposite of what the question describes and it is wrong.
- イ
正解 The correct answer is イ, a bot. A bot is a malicious program (malware) that lets an attacker freely control an infected computer from a remote location, and its name comes from the word robot. After infecting a computer it does not immediately carry out obvious destructive actions; instead it stays hidden so that the user does not notice it, and it communicates regularly with a C&C server (Command and Control server, that is, a command server) on the Internet, waiting for orders from the attacker. Once the attacker issues an order, the many infected computers all start the same action at the same time and carry out such acts as a DDoS attack (distributed denial of service attack) that sends huge numbers of packets to a particular site, mass sending of spam e-mail, and theft of information. A network made up of the many computers that are infected with a bot and placed under the attacker's control in this way is called a botnet, and the hijacked computers are made to take part in the attack as attackers themselves without their owners knowing. The three features listed in the question, namely that it infects a large number of computers, that it receives commands from an attacker via remote control, and that it carries out attacks such as DDoS attacks all at once, are exactly a description of how a bot behaves, and none of the terms in the other choices can explain this property of attacking all at once on remote command. Therefore the name of this malicious program is bot.
Incorrectウ
A macro virus is a virus that abuses the macro function (a program that automates operations) built into document files of spreadsheet software and word processing software. When an infected document file is opened, the macro runs automatically and may spread the infection to other document files or to templates, destroy files, or download other malware. What defines this category is the infection route and means of execution, namely macros in document files, and its definition does not include the property of many terminals receiving remote commands from an attacker and launching DDoS attacks all at once, so it is wrong as the name asked for in the question.
Incorrectエ
A worm is malware that can exist on its own without attaching itself to another program, and that spreads autonomously by sending copies of itself one after another through networks, e-mail, or external storage media. The core of its character is that it multiplies by itself without waiting for the attacker to operate it; although the increased traffic caused by this multiplication can put a load on the network, its definition does not include the remote control mechanism of receiving commands from a C&C server and launching attacks all at once. It is close as a description of infectiousness, but it does not satisfy the element the question stresses, namely receiving commands via remote control, so it is wrong. Note that some real malware multiplies like a worm while also having bot functions, but the name for that remotely controlled function is still bot.
ここがポイント
- Bots and botnets — A bot is malware that lets an attacker control an infected device remotely. It stays hidden while communicating with a C&C server (command server) and waiting for orders, and once an order comes down, many infected devices carry out DDoS attacks, spam sending, and the like all at once. The network of these hijacked devices is a botnet, and users are made to take part on the attacking side without knowing it.
- How to tell the main types of malware apart — The defining feature of a worm is that it copies itself and multiplies autonomously, that of a macro virus is that it abuses the macro function of document files, and that of a bot is that it is controlled by remote commands. Note that a honeypot is not malware at all but a decoy system on the defender's side that lures attacks in so their methods can be observed.
用語