問60
頻出度★★★
暗号資産 (仮想通貨) を入手するためのマイニングと呼ばれる作業を, 他人のコンピュータを使って気付かれないように行うことを何と呼ぶか。
令和2年度 ITパスポート試験 問60
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 60
- ア
正解 Cryptojacking is a word formed by combining 'crypto (crypto assets)' and 'hijacking,' and it refers to the illicit act of using the processing power of another person's computer or smartphone without their knowledge or consent in order to mine (dig for) crypto assets. The attacker plants malware or embeds a mining script into a web page so that the victim's CPU is put to work without permission, and the attacker takes the crypto assets that are generated. This exactly matches the question's description of performing mining by using another person's computer without them noticing, so the correct answer is ア.
Incorrectイ
Social engineering is the act of exploiting a person's psychological gaps or carelessness and using tricks such as conversation, shoulder-surfing, or impersonation to draw out passwords or confidential information. It is an attack aimed at people rather than technology, and it has nothing to do with mining by using another person's computing resources.
Incorrectウ
Buffer overflow is an attack or vulnerability in which data exceeding the capacity of a buffer allocated by a program is written in, and the overflowing portion is used to corrupt memory or execute malicious code. It exploits a flaw in memory management and is not a term that refers to mining crypto assets.
Incorrectエ
Phishing is a scam that uses email disguised as a legitimate company or financial institution to lure users to a fake website and have them enter information such as their ID, password, or credit card number so that it can be stolen. It is a technique for tricking people out of information, not the act of mining by using another person's computing resources without permission.
ここがポイント
- Cryptojacking = an attack that uses another person's computer processing power without permission and illicitly to mine crypto assets (crypto + hijacking).
- Grasp how it differs from similar security terms (social engineering = deceiving people, buffer overflow = corrupting memory, phishing = defrauding information via fake sites).
用語