問58
頻出度★★★
受信した電子メールに添付されていた文書ファイルを開いたところ, PC の挙動がおかしくなった。疑われる攻撃として, 適切なものはどれか。
令和2年度 ITパスポート試験 問58
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 58
Incorrectア
“SQL injection” is an attack that injects malicious SQL statements into input fields of a web application to illegitimately manipulate the backend database and steal information. Its target is the server-side database, which is unrelated to the situation in this question, where opening a document attached to an email makes the PC itself malfunction.
Incorrectイ
“Cross-site scripting (XSS)” is an attack that exploits a website vulnerability to embed a malicious script and have it run in the browser of a user who views that site. It is an attack carried out through the web browser and the site, and does not apply to a situation where the PC malfunctions after opening a document file attached to an email.
Incorrectウ
“Shoulder hacking” is the physical act of peeking over someone's shoulder at their keyboard operations or screen to steal information such as passwords. It is entirely different in nature from PC malfunction caused by malware, and cannot explain the symptoms in this question.
- エ
正解 The correct answer is “Macro virus”. A macro virus is a virus that abuses the macros (automated-processing programs) embedded in document files such as Word or Excel; when the document file is opened, the macro runs automatically and causes infection or malicious behavior. The situation in this question, where the PC starts behaving strangely right after opening a document file attached to an email, matches the typical infection route and symptoms of a macro virus that spreads through document files.
ここがポイント
- A macro virus is malware that abuses the macro feature of document files such as Word or Excel; it runs automatically and infects the system when the file is opened. Document files attached to emails are a representative infection route.
- SQL injection and XSS are attacks that target web applications, and shoulder hacking is information theft through peeking; none of them is the cause of the phenomenon in which the PC malfunctions after opening an attached document.
用語