問95
頻出度★★★
攻撃対象とは別の Web サイトから盗み出すなどによって, 不正に取得した大量の認証情報を流用し, 標的とする Web サイトに不正に侵入を試みるものはどれか。
令和4年度 ITパスポート試験 問95
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 95
Incorrectア
A DoS attack sends a target server a flood of accesses or overloading packets to halt or disrupt its service. It targets availability, not attempting to log in and break in with stolen authentication credentials.
Incorrectイ
SQL injection injects malicious SQL statements into a web input field to illicitly manipulate the database and steal information. It differs from the method of reusing authentication credentials stolen from another site to log in.
- ウ
正解 The answer is “ウ Password list attack”. In a password list attack, ID-and-password pairs (a list of authentication credentials) that were leaked or stolen from a different website are reused as-is against the target website to attempt logins; it is also called credential stuffing. This exactly matches the wording of the question: stolen from a website other than the target, reusing large amounts of illegally obtained authentication credentials, and attempting to break into the target site. Its key feature is that it exploits the fact that many users reuse the same ID and password across multiple sites.
Incorrectエ
Phishing uses fake sites or fake emails that closely imitate the real thing to deceive the user directly and get them to enter, and thereby steal, their ID, password, and so on. This differs from the question’s premise of reusing authentication credentials stolen from another site.
ここがポイント
- Password list attack (credential stuffing) = an attack that reuses ID-and-password pairs leaked from other sites against the target site to attempt logins. Password reuse widens the damage.
- Countermeasures are to set a different password for each site and to introduce multi-factor authentication. Distinguish and memorize the definitions of the attack methods (DoS, SQL injection, phishing).
用語