問84
頻出度★★★
社内の PC でマルウェアが発見された。そのマルウェアが他の PC にも存在するかどうかを調査する方法として, 最も適切なものはどれか。
平成30年度 秋期 ITパスポート試験 問84
This question's explanation and your answers so far.
解説
問 84
Incorrectア
Access rights (permission settings such as read, write, and execute) only indicate who can operate on the file and how; they have nothing to do with the file's content. A great many harmless files share the same access rights, and conversely the malware's access rights may differ from PC to PC, so they cannot serve as a basis for judging whether it is the same malware.
Incorrectイ
A file extension (such as .exe) is merely part of the name and does not guarantee the content. There are countless normal files with the same extension, and malware often disguises or changes its extension, so a matching extension cannot distinguish whether it is the same malware.
Incorrectウ
The owner is an attribute indicating the user who creates and holds the file, and is unrelated to the content. Harmless files created by the same user also have the same owner, and depending on the infection route the malware's owner may vary from PC to PC, so it is inappropriate as a means of identifying the same malware.
- エ
正解 A hash value is a fixed-length value obtained by passing a file's entire content through a hash function; files with exactly identical content always produce the same hash value (conversely, if even one byte differs, the value changes). Therefore, if you search other PCs for files that have the same hash value as the discovered malware, you can identify the very same malware body itself with high certainty. Even if the file name or extension is changed, the value still matches as long as the content is the same, so this is also effective for tracking malware that disguises its name. This is the most appropriate way to investigate whether the same malware exists, and the correct answer is エ.
ここがポイント
- A hash value (the output of a hash function) is uniquely determined by the file's content: identical content yields the same value, and even a slight difference yields a different value. Using this property, you can reliably match the same file (the same malware) even if its name has been changed.
- Access rights, file extension, and owner are all attributes or names of a file and do not guarantee the content itself. For judging whether malware is identical, content-based hash-value matching is optimal.
用語