問58
頻出度★★★
Web サイトなどに不正なソフトウェアを潜ませておき, PC やスマートフォンなどの Web ブラウザからこのサイトにアクセスしたとき, 利用者が気付かないうちに Web ブラウザなどの脆弱性を突いてマルウェアを送り込む攻撃はどれか。
令和5年度 ITパスポート試験 問58
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 58
Incorrectア
A DDoS attack sends a flood of traffic from many devices at once, overloading the target server or network to bring its service to a halt. It does not exploit a vulnerability in the user’s browser to inject malware.
Incorrectイ
SQL injection injects malicious SQL statements into the input fields of a Web application to illicitly manipulate or read the back-end database. It targets the server-side database, which is mechanistically different from a drive-by download that exploits the visitor’s browser vulnerability.
- ウ
正解 The correct answer is ウ “Drive-by download”. It refers to an attack in which malicious code is planted in advance on a website, and merely viewing that site exploits a vulnerability in the Web browser or a plug-in to automatically download and run malware without the user noticing. This matches exactly the question’s wording: “when accessing the site”, “without the user noticing”, and “exploiting a browser vulnerability to inject malware”.
Incorrectエ
A phishing attack uses fake websites or fake emails that closely imitate the real ones to lure users into voluntarily entering information such as IDs, passwords, or credit card numbers, which is then stolen. Its essence is deceiving the user, not exploiting a browser vulnerability to automatically inject malware.
ここがポイント
- A drive-by download is an attack in which merely viewing a tampered or specially crafted website exploits a browser or plug-in vulnerability to automatically download and infect the device with malware. Its hallmark is that no click or explicit download action is required.
- Countermeasures include always keeping the browser, OS, and plug-ins updated to the latest versions to close vulnerabilities, and installing security software. Learn to distinguish the differences in aim and mechanism among the attack names (DDoS / SQL injection / phishing / drive-by download).
用語