IPA IP 2022 Question 95
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問95, translated into English. ITPEC is based on the same exams.
Which of the following is an attack that diverts a large amount of authentication information obtained illegitimately, such as by stealing it from a website other than the attack target, and attempts to intrude illegitimately into the targeted website?
Explanation
Password list attack — IDs and passwords leaked from one website are tried, as a list, on another website.
Many people reuse the same ID and password on several websites. An attacker who has a list of IDs and passwords stolen from one site, or bought after a leak, feeds the list to the login page of a different target site. Every user who reused the pair can then be logged in as. The attack is also called credential stuffing; the defence on the user's side is a different password for every site, and on the site's side multi-factor authentication and the detection of mass login attempts.
Answer (c)
Why not others:
- •(a) — a DoS attack floods a server with requests to stop its service; it uses no authentication information
- •(b) — SQL injection enters crafted SQL into an input field to manipulate the database; it attacks the application, not with stolen passwords
- •(d) — phishing tricks users into entering their information on a fake site; it is a way of stealing authentication information, not of reusing it on another site
Key rule: Reusing passwords lets one site's leak open other sites; trying a stolen list of IDs and passwords on another site is a password list attack.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.