問59
頻出度★★★
情報セキュリティにおける脅威であるバッファオーバフローの説明として, 適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問59
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 59
Incorrectア
Continuously sending a large number of connection requests to a specific server to disrupt its service is a description of a DoS attack (denial-of-service attack). When it is carried out simultaneously from many devices, it is called a DDoS attack. Its aim is to exhaust resources and lock out legitimate users, which is a different mechanism from buffer overflow, where memory areas are made to overflow in order to seize control.
Incorrectイ
Sending a large number of emails to a specific email address so that the user's mailbox is filled up and new emails can no longer be received is a description of a mail bomb. This is also a kind of denial of service, but the target of the attack is the capacity of the mailbox, which is different from a buffer overflow, where a buffer inside a program is made to overflow.
Incorrectウ
Eavesdropping on passwords flowing through the network and using them to gain unauthorized access is a description of eavesdropping (sniffing) and the impersonation based on it. It is an act of intercepting information on the communication path, not an attack that destroys the memory areas of a program. Its countermeasure is also encryption (such as TLS), which differs from the input-length checking used against buffer overflow.
- エ
正解 The correct answer is エ. A buffer overflow is an attack in which data larger than the memory area (buffer) that a program has reserved in advance for input is sent in, and the overflowing part overwrites the adjacent memory area. The overwritten location may hold data related to the control of the program, such as the return address of a function, so by rewriting it an attacker can make the program terminate abnormally or execute arbitrary code that the attacker supplied. Choice エ, “Inputting data larger than the size of the input data area prepared by a program, causing it to behave in an unintended way”, describes exactly this mechanism, so it is appropriate. The countermeasures are defenses on the program side: always check the length of the input data (bounds checking), use safe functions, and apply security patches.
ここがポイント
- Buffer overflow = an attack that supplies data exceeding the capacity of the input memory area (buffer) reserved by a program, overwrites the adjacent area, and thereby causes abnormal behavior or arbitrary code execution. The countermeasures are bounds checking of the input length and applying patches that fix the vulnerability.
- Distinguishing it from similar “send a large amount” threats: sending many connection requests = DoS / DDoS attack, sending many emails = mail bomb, secretly reading communications = eavesdropping (sniffing). Tell them apart by whether the target of the attack is memory inside a program, server resources, or the communication path.
用語