問91
頻出度★★★
クロスサイトスクリプティングなどの攻撃で, Cookie が漏えいすることによって受ける被害の例はどれか。
平成29年度 秋期 ITパスポート試験 問91
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 91
Incorrectア
A PC becoming infected with a virus is damage that occurs through other routes, such as downloading or running malicious programs; merely leaking a Cookie (authentication information used in exchanges with a web service) does not cause the PC to be infected with a virus.
Incorrectイ
Files inside the PC being sent to an external party is damage that occurs when internal files of the PC are accessed due to causes such as malware infection. A Cookie is merely information handled between the browser and the web server; even if it leaks, it does not directly lead to sending local files inside the PC.
- ウ
正解 Cookies often store information that maintains authentication state, such as a session ID indicating that the user is logged in to a web service. When a malicious script injected through cross-site scripting (XSS) steals a Cookie from the user’s browser and sends it to the attacker, the attacker only has to set that Cookie (session ID) in their own browser to impersonate the legitimate user and reproduce the logged-in state (session hijacking). As a result, even someone who is not the user can operate the account of the web service, so “the account of a web service is hijacked” is the correct example of damage caused by Cookie leakage. Therefore the correct answer is ウ.
Incorrectエ
Network intrusion via a wireless LAN is damage caused by other attacks targeting the network side, such as vulnerabilities in the wireless LAN encryption scheme or password cracking, and is unrelated to the leakage of a Cookie, which is authentication information for a web service.
ここがポイント
- Cookies often store authentication information such as a session ID; if leaked through XSS or the like, an attacker can impersonate the user, leading to the damage of session hijacking (account takeover).
- Distinguish the types of damage by their attack target: Cookie leakage targets “the account of a web service,” and differs in both cause and target from virus infection, local file theft, and network intrusion.
用語