問60
頻出度★★★
オンラインバンキングにおいて, マルウェアなどでブラウザを乗っ取り, 正式な取引画面の間に不正な画面を介在させ, 振込先の情報を不正に書き換えて, 攻撃者の指定した口座に送金させるなどの不正操作を行うことを何と呼ぶか。
平成30年度 秋期 ITパスポート試験 問60
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 60
- ア
正解 The correct answer is (ア), the MITB (Man In The Browser) attack. In an MITB attack, malware that has infected the user's PC hijacks the browser itself and inserts fraudulent processing between the legitimate transaction screen and the user. As the question states, even though the user has logged in to the correct bank site with the correct ID and password, information such as the transfer-recipient account number and the amount is secretly rewritten inside the browser, causing funds to be sent to an account specified by the attacker. Because the tampering happens inside the browser rather than on the communication path, it cannot be prevented even when encrypted communication using SSL/TLS is applied, and on screen it still looks like a normal transaction. This is its distinguishing feature and matches the question's description exactly.
Incorrectイ
SQL Injection is an attack in which malicious SQL statements are injected into input fields of a web application to illegitimately manipulate or read the database behind it. Its target is the database on the server side, which differs from hijacking the user's browser and tampering with the transfer screen, so it is incorrect.
Incorrectウ
Social engineering is a general term for techniques that steal information by exploiting weaknesses in human psychology and behavior, such as impersonation phone calls, shoulder surfing, and dumpster diving. It is not a technical tampering method that hijacks the browser with malware, so it is incorrect.
Incorrectエ
A brute-force attack (exhaustive search attack) is a technique that tries every possible combination of a password or encryption key one after another in an attempt to break through authentication. It does not hijack the browser and rewrite transaction information, so it is incorrect.
ここがポイント
- An MITB attack is a technique in which malware hijacks the browser and tampers with information such as the transfer recipient inside the legitimate transaction screen. The key point is that it cannot be prevented even when the communication is encrypted, and it still looks like a normal transaction to the user.
- Grasp the difference in location: the similar Man-in-the-Middle (MITM) attack intervenes partway along the communication path, whereas MITB intervenes inside the user's browser.
用語