問74
頻出度★★★
ゼロデイ攻撃の説明として, 適切なものはどれか。
平成25年度 秋期 ITパスポート試験 問74
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 74
Incorrectア
This describes a port scan. It is a reconnaissance activity that accesses a server while changing TCP/IP port numbers one after another, looking for open or vulnerable ports that could become an entry point for intrusion; it amounts to preliminary investigation done before an attack. It has nothing to do with the timing element unique to a zero-day attack — whether the vulnerability has been disclosed and whether it is before a patch is provided — so it is wrong.
Incorrectイ
This describes social engineering. It exploits gaps in human psychology and behavior — clever talk aimed at administrators or users (such as an impersonation phone call) or peeking (shoulder surfing) — to extract important information such as passwords, and then intrudes into the system by impersonating a legitimate user. It is not a technical attack that exploits a software vulnerability, so it cannot be a description of a zero-day attack.
- ウ
正解 The correct answer is ウ. A zero-day attack is an attack that exploits a vulnerability during the period after the vulnerability in software has been found but before the vendor provides a fix program (security patch) for it — in other words, during the defenseless period in which users have no effective countermeasure available. If the day the patch is released is counted as “day 1”, the attack is launched before that (day 0), and this is where the name “zero-day” comes from. Choice ウ, “An attack carried out by exploiting a discovered vulnerability in software before the vendor provides a patch (fix program) for it, after the vulnerability has been found”, states this definition exactly, with nothing missing or added, so it is appropriate. The key point is that this attack is defined not by its attack technique but by its timing — before the patch is provided — and ウ is the only choice that carries this time-axis description.
Incorrectエ
This describes a dictionary attack (and its extended form, the hybrid attack). It transforms words listed in a dictionary by mixing uppercase and lowercase letters or adding numbers, generates large numbers of candidate strings, and tries them one after another at random in order to crack passwords or decrypt ciphertext. What it targets is how easy a password is to guess — not an unfixed vulnerability, and not the time gap before a patch is provided — so it is wrong.
ここがポイント
- Definition of a zero-day attack: an attack that strikes during the period between the discovery of a vulnerability and the vendor’s provision of a fix program (security patch), when no effective countermeasure exists. The core point is that it is defined not by the type of technique but by the timing — before the patch is provided.
- Telling similar security attack terms apart: port scan (preliminary reconnaissance that looks for open ports), social engineering (obtaining information by exploiting gaps in human psychology and behavior), and dictionary attack (transforming dictionary words and cracking passwords by exhaustive trial) — make sure you can distinguish each of them.
用語