問63
頻出度★★★
フィッシングの説明として, 適切なものはどれか。
平成28年度 春期 ITパスポート試験 問63
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 63
Incorrectア
An attacker sending commands over a network to a virus-infected PC to make it run malicious programs describes an attack that remotely controls a bot (a stepping-stone host) — control via a botnet / C&C server — not phishing.
- イ
正解 Phishing is an attack in which the attacker sends e-mails disguised as those from legitimate businesses such as financial institutions or credit card companies, lures users to a fake site (a phishing site) built to look exactly like the real one, and there gets them to enter important information such as PINs, passwords, and credit card numbers in order to steal it illegitimately. Choice イ states exactly this technique — “disguising as an e-mail from a financial institution or similar, luring users to a fake site to illegitimately obtain information such as PINs and credit card numbers” — so it is the correct answer. It is also characteristic of a social-engineering attack that exploits a gap in the user's psychology.
Incorrectウ
Using dictionary data that exhaustively lists strings likely to be used as passwords to figure out a password describes a dictionary attack. It mechanically analyzes the password itself, which differs from phishing that lures users to a fake site.
Incorrectエ
Sending a large number of packets from multiple computers to a target server to halt the server's functions describes a DDoS attack (distributed denial-of-service attack). It differs from information-stealing phishing in both purpose and method.
ここがポイント
- Definition of phishing: a social-engineering attack that deceives users with e-mails or fake sites impersonating legitimate organizations in order to steal important information such as PINs, passwords, and card numbers.
- Distinguishing from similar attacks: tell it apart from remote bot control (ア), dictionary attacks (ウ), and DDoS attacks (エ) by their purpose (stealing information vs. disrupting service vs. illicit control) and their technique.
用語