問95
頻出度★★★
あるWebサイトからIDとパスワードが漏えいし, そのWebサイトの利用者が別のWebサイトで, パスワードリスト攻撃の被害に遭ってしまった。このとき, Webサイトで使用していたIDとパスワードに関する問題点と思われる記述はどれか。
平成29年度 春期 ITパスポート試験 問95
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 95
Incorrectア
“Unencrypted communication” refers to the risk of eavesdropping on the communication path (interception by a man in the middle). However, the damage in this question happened because the attacker reused, on a different website, the ID and password pair that had already been leaked from another site. Whether the communication is encrypted has nothing to do with whether a password list attack succeeds, so it is not an appropriate problem point.
- イ
正解 A password list attack (credential stuffing) is an attack in which the attacker takes the pairs of ID and password leaked from one website and tries them one after another on the login page of a different website. The fact that this attack succeeded on the other website means the victim reused the same ID and the same password on both websites. The pair leaked from one site worked as valid login credentials on the other site as well. Therefore the problem is that the same ID and the same password were set (reused), so choice イ is correct.
Incorrectウ
A password made up of only a few types of characters is weak because it is easy to guess through brute-force or dictionary attacks. However, a password list attack directly uses the leaked correct password itself, so the number of character types has nothing to do with whether the attack succeeds. Therefore this is not the direct problem in this case.
Incorrectエ
A short password is likewise weak because the fewer the digits, the easier it is to break by brute force, which is the same kind of issue as ウ. A password list attack reuses a known correct password, so the length of the password is irrelevant. Therefore this is not the problem being asked about in this case.
ここがポイント
- Definition of a password list attack (credential stuffing): an attack that takes ID and password pairs leaked from one place and tries them as-is on the login pages of other websites. The reuse of IDs and passwords is the precondition for the damage.
- Key countermeasure: do not reuse the same ID and password across multiple websites; instead set a different password for each site. This is a different perspective from strengthening a password through its length or character types (which counters brute force).
用語