問73
頻出度★★★
攻撃者がコンピュータに不正侵入したとき, 再侵入を容易にするためにプログラムや設定の変更を行うことがある。この手口を表す用語として, 最も適切なものはどれか。
令和5年度 ITパスポート試験 問73
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 73
Incorrectア
Eavesdropping is the act of illegally intercepting communication data while it travels across the network and secretly reading its contents. It is a technique for stealing information, not for planting a backdoor used for re-intrusion, so it is incorrect.
- イ
正解 The correct answer is イ, Backdoor. A backdoor is a hidden entrance that an attacker secretly plants on a computer they have already broken into, so that future intrusions become easier. Concrete examples include creating a hidden account that bypasses authentication, leaving a resident program that waits for connections from the outside, or tampering with settings so the machine can be operated remotely. The statement in the question, modifying programs or settings to make re-intrusion easier, refers exactly to planting such a backdoor.
Incorrectウ
Phishing is a fraud technique that disguises itself as a real company through fake emails or fake websites, luring users into entering their ID, password, credit card number, and so on, in order to steal them. It is a technique for deceiving users, which differs from creating a backdoor after intrusion, so it is incorrect.
Incorrectエ
Port scanning is a reconnaissance act performed before intrusion: the attacker tries to connect to each port on the target computer to find out which ports are open (which services are running). It belongs to the preparation stage of an intrusion, not a mechanism placed after intrusion for re-entry, so it is incorrect.
ここがポイント
- Backdoor = a hidden entrance that an attacker who has successfully broken in secretly plants to make re-intrusion easier (hidden accounts, resident programs, tampered settings, and so on).
- Tell a backdoor apart from eavesdropping, phishing, and port scanning by which stage of the attack each belongs to (prior reconnaissance, securing a foothold after intrusion, or defrauding information).
用語