令和2年度 ITパスポート試験問56

This question's explanation and your answers so far.

問56

頻出度★★★

HTML 形式の電子メールの特徴を悪用する攻撃はどれか。

出典　令和2年度 ITパスポート試験問56

解説

問 56

Incorrectア
A DoS attack sends a massive volume of requests or malformed packets to bring a server or service down or overload it. Its target is the availability of the service; it does not exploit the characteristic that HTML-format email can embed scripts.
Incorrectイ
SQL injection inserts malicious SQL statements into the input fields of a web application to illegitimately manipulate or read the database behind it. Its target is the web application and the database, and it has nothing to do with the characteristics of HTML email.
ウ
正解 Unlike plain-text format, HTML-format email has the characteristic that HTML tags and scripts (such as JavaScript) can be embedded in the body. When this characteristic is abused, simply opening or previewing the email lets the embedded malicious script run, leading to harm such as theft of information or redirection to illegitimate sites. Therefore the correct answer is “Execution of a malicious script.” Countermeasures include disabling automatic script execution in the mail client and displaying HTML mail in plain-text format.
Incorrectエ
A dictionary attack tries words listed in a dictionary and commonly used strings one after another to crack a password. Its purpose is to break through authentication, and it is unrelated to the characteristic that HTML-format email can embed scripts.

ここがポイント

HTML-format email can embed scripts (such as JavaScript) in the body, so it is more dangerous than plain-text format; a malicious script may run just from opening the email.
DoS attacks, SQL injection, and dictionary attacks target availability, the database, and authentication respectively, and are different kinds of attacks; memorize the target and characteristics of each attack method separately.

用語

解答問56ウ