This question's explanation and your answers so far.
情報セキュリティの脅威に関する説明①～③と，用語の適切な組合せはどれか。 ① Webページに，利用者の入力データをそのまま表示するフォーム又は処理があるとき，第三者が悪意あるスクリプトを埋め込み，訪問者のブラウザ上で実行させることによって，cookieなどのデータを盗み出す攻撃 ② 多数のPCに感染し，ネットワークを介した指示に従ってPCを不正に操作することによって，一斉攻撃などを行うプログラム ③ 利用者に有用なプログラムと見せかけて，インストール及び実行させることによって，利用者が意図しない情報の破壊や漏えいを行うプログラム
① as XSS is correct, but ② and ③ are swapped. ②, which describes operating many PCs at once via remote instructions, is the description of a Bot, not a Trojan Horse; and ③, which disguises itself as useful software to get executed, is a Trojan Horse, not a Bot. Because ② and ③ are reversed, this choice is wrong.
正解 Descriptions ①–③ are each the definition of the following threats. ① is an attack in which, on a Web page that displays user input as-is (a vulnerable form or process), a third party embeds a malicious script and has it run in the visitor's browser to steal data such as cookies — this is exactly Cross-Site Scripting (XSS). ② is a program that infects a large number of PCs and, following instructions sent over a network, illegally operates them to carry out coordinated attacks; it is a remotely controlled Bot, the malware that makes up a botnet. ③ is a program that disguises itself as software useful to the user, gets installed and executed, and secretly performs destruction or leakage of information; it is a Trojan Horse that intrudes by concealing its true nature. Therefore ① is Cross-Site Scripting, ② is Bot, and ③ is Trojan Horse, and the correct answer is “イ”.
Treating ① as a targeted attack is wrong. A targeted attack broadly refers to attacks that aim at a specific organization or individual and intrude via email and the like, whereas the technique in ① — embedding a script into a Web page that displays input as-is — corresponds to XSS. In addition, treating ② as XSS is also wrong; ② is the description of a Bot.
Treating ① as a targeted attack is wrong (① is XSS). In addition, it treats ③ as XSS, but ③ — disguising itself as a useful program to get executed and performing destruction or leakage — is the description of a Trojan Horse, which is different from XSS that runs a script in a Web browser. All of the term correspondences are misaligned.