IPA IP 2023 Question 58
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問58, translated into English. ITPEC is based on the same exams.
Which of the following is an attack in which unauthorized software is planted on a website or other such place, and when the site is accessed from the web browser of a PC, smartphone, or other such device, malware is sent in by exploiting a vulnerability of the web browser or other such software without the user noticing?
Explanation
Drive-by download — merely visiting a tampered website installs malware through a browser vulnerability, without the user doing anything else.
The attacker plants malicious code on a website, often a legitimate site it has broken into. When a browser with an unpatched vulnerability (in the browser itself or in a plug-in) opens the page, the code exploits it and downloads and runs malware in the background. The user clicks no link and approves no download, so nothing seems wrong.
Answer (c)
Why not others:
- •(a) — a DDoS attack floods a server with traffic from many machines to stop its service; it does not infect visitors
- •(b) — SQL injection enters SQL fragments into a web application's input to read or alter its database; it targets the server, not the visitor's browser
- •(d) — a phishing attack lures users with a fake e-mail or site to hand over passwords or card numbers; it relies on deceiving the user, not on a browser vulnerability
Key rule: Keep the OS, browser and plug-ins patched: a drive-by download needs only a visit to the page and an unpatched vulnerability.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.