問61
頻出度★★★
マルウェアに関する説明a～cとマルウェアの分類の適切な組合せはどれか。 a 感染したコンピュータが,外部からの指令によって,特定サイトへの一斉攻撃,スパムメールの発信などを行う。 b キーロガーなどで記録された利用者に関する情報を収集する。 c コンピュータシステムに外部から不正にログインするために仕掛けられた侵入路である。
平成26年度 春期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 61
Incorrectア
It is wrong in treating a as “Spyware” and b as “Trojan Horse”. Description a is about carrying out coordinated attacks and sending spam according to commands from the outside, so it corresponds to a Bot, not to spyware that steals information. Also, b is the collection of user information recorded by a keylogger, so it is spyware, not a Trojan horse that disguises itself as useful software in order to get in. Only c: Backdoor is correct, but a and b are swapped, so the combination as a whole is inappropriate.
Incorrectイ
Treating a as “Spyware” is the same mistake as in ア: coordinated attacks and spam sending driven by remote commands are characteristics of a Bot. In addition, it treats b as “Backdoor” and c as “Trojan Horse”, so the pairings for b and c are swapped as well. Description b, “collects user information recorded by a keylogger”, is spyware, and description c, “an intrusion path planted for illegal login”, is a backdoor, so all three items deviate from the correct classification.
- ウ
正解 Matching the three descriptions one by one against the classifications of malware gives “ウ”. Description a is “An infected computer carries out coordinated attacks on a specific site, sends spam emails, and so on, according to commands from the outside” — this is malware that is remotely controlled by the attacker's commands (orders from a C&C server) and used as a stepping stone, that is, a “Bot”. A state in which many bot-infected machines are controlled together is called a botnet, and they become the force that carries out DDoS attacks and mass spam sending. Description b is “It collects information about users that has been recorded by a keylogger or the like” — software that gathers information without the user noticing and sends it outside is “Spyware”. A keylogger is a mechanism that records keystrokes, and it is a typical technique spyware uses to collect information. Description c is “an intrusion path planted in order to log in illegally from the outside” — a secret back way created so that regular authentication can be bypassed is a “Backdoor”. Therefore the pairing is a: Bot / b: Spyware / c: Backdoor, and the only choice showing this arrangement in the table is “ウ”.
Incorrectエ
Although a: Bot is correct, treating b as “Trojan Horse” and c as “Spyware” is wrong. A Trojan horse is malware that pretends to be harmless, useful software so that users install it themselves and then performs unauthorized actions behind the scenes; this does not match description b, “collects user information recorded by a keylogger” (b is spyware). Also, description c, “an intrusion path for logging in illegally from the outside”, is the definition of a backdoor, not of spyware that steals information.
ここがポイント
- Identify malware classifications by their function: Bot = remotely controlled by commands from the outside (a C&C server) and used as a stepping stone for DDoS attacks or spam sending; Spyware = collects information without the user noticing and sends it outside (a keylogger is its typical technique); Backdoor = a back way planted so that regular authentication can be bypassed for intrusion.
- The easily confused Trojan horse is malware that “disguises itself as useful, harmless software so that users install it themselves and then performs unauthorized actions behind the scenes”; it is classified by its infection route and disguise, that is, by how it gets in. That is the key point distinguishing it from Bot, Spyware, and Backdoor, which are classified by what they do.
用語