IPA IP 2020 Question 56
A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問56, translated into English. ITPEC is based on the same exams.
Which of the following is an attack that exploits the characteristics of e-mail in HTML format?
Explanation
Execution of a malicious script — an HTML e-mail can carry scripts and links that run or load when the message is displayed.
An HTML-format e-mail is displayed like a web page, so it can contain scripts, embedded images loaded from outside servers, and links whose shown text differs from their real destination. An attacker can embed a malicious script that runs when the mail is opened or previewed in a mail client that executes it. This is why HTML display and scripts are often turned off and text format is recommended for mail.
Answer (c)
Why not others:
- •(a) DoS attack — floods a server or network with requests to stop its service; it does not depend on the mail's format
- •(b) SQL injection — sends crafted input to a web application so that unintended SQL runs against its database
- •(d) Dictionary attack — tries words from a dictionary as passwords to log in
Key rule: HTML mail can execute scripts and hide link destinations, so the attack tied to its features is running a malicious script; plain text mail cannot.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.