108 年 國立中央警察大學資訊管理研究所《電腦犯罪與資訊安全》

本題主要在檢測考生對於分散式阻斷服務攻擊（DDoS）的理解程度，包括其定義、攻擊手法，以及相應的防禦策略。

（一）DDoS 攻擊定義與舉例說明：

DDoS 攻擊，全名為分散式阻斷服務攻擊（Distributed Denial of Service Attack），是一種網路攻擊，其目標是透過癱瘓目標伺服器、服務或網路，使其無法正常提供服務給合法使用者。攻擊者通常會利用大量的被感染電腦（稱為殭屍網路，Botnet）作為攻擊媒介，從多個來源同時向目標發送大量的請求或惡意流量，以壓垮目標的處理能力、頻寬或資源，進而導致服務中斷。

舉例說明：

1. HTTP Flood 攻擊：攻擊者控制大量殭屍主機，同時向目標網站發送海量 HTTP 請求。這些請求可能包含合法的請求，但數量龐大到伺服器無法及時處理，導致伺服器資源耗盡，無法回應合法使用者的請求。
2. SYN Flood 攻擊：利用 TCP 三向交握機制的弱點。攻擊者發送大量的 TCP SYN 請求（要求建立連線），但故意不完成最後一步。伺服器會為每個 SYN 請求保留資源（例如記憶體）等待 ACK 回應，但由於攻擊者不回應，這些資源會被佔用，最終耗盡伺服器連線處理能力。
3. DNS Amplification 攻擊：攻擊者向開放的 DNS 解析伺服器發送一個較小的查詢請求，並偽造來源 IP 位址為目標伺服器的 IP 位址。DNS 伺服器在回應時會發送比原始請求大得多的數據包給目標伺服器，攻擊者利用這種「放大」效應，用較少的資源發動大規模攻擊。
4. Botnet 攻擊：這是 DDoS 攻擊最常見的模式。攻擊者事先透過惡意軟體感染大量電腦，將其組建成殭屍網路（Botnet）。攻擊者可以遠端指揮這些殭屍電腦，在同一時間對特定目標發動各種形式的 DDoS 攻擊，例如上述的 HTTP Flood 或 SYN Flood。

（二）DDoS 攻擊的防禦方法：

DDoS 攻擊的防禦需要多層次的策略，從網路邊界到應用程式層都需有所部署：

1. 頻寬擴充與資源備援：
   • 增加頻寬：確保網路頻寬足以應對突發的大流量，但這只能緩解流量壓力，無法阻止攻擊。
   • 負載平衡（Load Balancing）：將流量分散到多台伺服器上，避免單點過載。

本題旨在考察考生對我國《刑法》中「妨害電腦使用罪」相關條文的理解，包括其構成要件、犯罪態樣以及具體案例。

我國《刑法》中關於妨害電腦使用罪的相關規定主要散見於第 358 條至第 362 條，這些條文涵蓋了不同類型的電腦犯罪行為。以下列舉常見的犯罪態樣並舉例說明：

1. 無故侵入他人電腦罪（《刑法》第 358 條）

   • 犯罪態樣：意圖妨害、侵占或取得他人電腦、相關設備或其處理之電磁紀錄，而無故侵入其電腦或其相關設備者。
   • 構成要件：
     • 行為人必須是「無故」侵入。
     • 侵入的對象是「他人」的電腦或相關設備。
     • 行為人具有「意圖妨害、侵占或取得」的目的。
   • 舉例說明：
     • 駭客利用弱點，未經授權下載公司內部機密資料。
     • 員工離職後，利用之前留下的後門帳號登入公司伺服器，企圖刪除或竊取公司客戶名單。
     • 未經同意，擅自使用他人電腦的遠端桌面功能進行瀏覽或操作。

2. 干擾電腦或其相關設備罪（《刑法》第 359 條）

   • 犯罪態樣：意圖妨害、侵占或取得他人電腦、相關設備或其處理之電磁紀錄，而擅自減損、變更或輸入其電磁紀錄，或指示他人為之者。
   • 構成要件：
     • 行為人必須是「擅自」為之。
     • 對象是「他人」電腦或其處理的「電磁紀錄」。
     • 行為方式包括：減損（刪除）、變更（修改）、輸入（新增、偽造）電磁紀錄。
     • 目的與第 358 條相同，意圖妨害、侵占或取得。
   • 舉例說明：
     • 在公司的會計系統中，擅自修改銷貨紀錄，虛增營收。
     • 在學校的成績系統中，修改學生的分數以提高其學業成績。
     • 植入惡意程式，導致伺服器上的資料損毀或無法讀取。

3. 妨害電腦或其相關設備功能罪（《刑法》第 360 條）

   • 犯罪態樣：意圖妨害、侵占或取得他人電腦、相關設備或其處理之電磁紀錄，而對其電腦或相關設備為妨害其功能之行為者。
   • 構成要件：
     • 行為人必須對「他人」的電腦或相關設備為「妨害其功能」的行為。

本題主要考察考生對勒索軟體（Ransomware）的理解，包括其定義、運作機制，以及作為 IT 專業人員應如何進行防護。

1. What is ransomware?
   Ransomware is a type of malicious software (malware) designed to deny a user access to their computer system or data until a ransom is paid. It encrypts the victim's files or locks their system, making them inaccessible. The attackers then demand a ransom payment, usually in cryptocurrency, in exchange for the decryption key or the restoration of access.

2. How does ransomware work?
   Ransomware typically operates through the following stages:

   • Infection：Ransomware spreads to a victim's system through various methods, including:
     • Phishing Emails：Users receive emails with malicious attachments (e.g., Word documents, PDFs, ZIP files) or links that, when opened or clicked, download and execute the ransomware.
     • Malicious Websites/Downloads：Visiting compromised websites or downloading software from untrusted sources can lead to ransomware infection.
     • Exploiting Vulnerabilities：Ransomware can exploit unpatched vulnerabilities in operating systems, applications, or network services to gain access and install itself.
     • Remote Desktop Protocol (RDP) Exploitation：Weak or exposed RDP credentials can be brute-forced or compromised, allowing attackers to gain direct access and deploy ransomware.
   • Execution and Encryption/Locking：Once installed, the ransomware begins its malicious payload. This usually involves:
     • File Encryption：The ransomware scans the system for specific types of files (documents, images, databases, etc.) and encrypts them using strong cryptographic algorithms (e.g., AES, RSA). The original unencrypted files are often deleted, leaving only the encrypted versions.
     • System Locking：Some ransomware variants might lock the entire operating system, preventing the user from accessing their desktop or any applications.
   • Ransom Demand：After encryption or locking, the ransomware displays a message to the victim. This message typically informs them that their files have been encrypted or their system locked, and provides instructions on how to pay the ransom (usually in Bitcoin or other cryptocurrencies to maintain anonymity) to receive the decryption key or unlock the system. The message often includes a deadline, threatening to permanently delete the decryption key or increase the ransom amount if not paid within the specified time.
   • Decryption (if paid)：If the victim pays the ransom, the attackers may provide a decryption tool or key. However, there is no guarantee that the attackers will uphold their end of the bargain. Even if they do, the decryption process can be slow and may not fully restore all files.

3. As an IT professional, how do you protect your organization from ransomware?
   Protecting an organization from ransomware requires a multi-layered defense strategy focusing on prevention, detection, response, and recovery.

   • Prevention Measures：

本題涉及數位鑑識（Digital Forensics）的應用，特別是針對行動裝置（ smartphones）的鑑識取證。考察考生對於手機中可能存在的證據類型，以及合法、有效地獲取這些證據的方法的認知。

1. What do you think you can find on their phones?
   Given the suspicion of communication related to a drug case's delivery and pickup, smartphones are likely to contain significant digital evidence. This evidence can be found in various forms:

   • Communication Records：
     • Call Logs：Incoming, outgoing, and missed calls, including timestamps and duration.
     • SMS/MMS Messages：Text messages and multimedia messages exchanged between suspects or with other parties.
     • Instant Messaging App Data： Conversations from apps like WhatsApp, LINE, Telegram, WeChat, Signal, etc. This includes text, photos, videos, audio messages, documents, and location sharing.
     • Email：Sent and received emails, potentially containing details about the drug operation.
   • Location Data：
     • GPS Logs： Recorded location data from GPS, Wi-Fi, and cellular triangulation, showing where the suspects have been.
     • Geotagged Photos/Videos： Media files that have location information embedded in their metadata (EXIF data).
     • App-Specific Location Data： Many apps record location history (e.g., Google Maps, social media check-ins).
   • Multimedia Files：
     • Photos and Videos： Potentially showing drug packaging, meeting locations, participants, or other relevant activities.
     • Audio Recordings： Voice notes or recordings made by the suspects.
   • Internet Activity：
     • Browser History： Websites visited, search queries, downloaded files.
     • Cache Data： Temporary files from visited websites that might contain fragments of information.
     • Social Media Activity： Posts, messages, and interactions on platforms like Facebook, Instagram, Twitter.
   • Application Data：
     • App Usage Logs： Information about which apps were used, when, and for how long.
     • App-Specific Databases： Many apps store data locally (e.g., notes, to-do lists, banking apps, encrypted messaging app databases).
   • Device Metadata：
     • Contacts List： Names, phone numbers, email addresses, and other contact information.
     • Device Identifiers： IMEI, IMSI, MAC addresses, which can be crucial for linking devices.
     • System Logs： Information about device events, errors, and user activity.
   • Deleted Data： Even deleted files and messages might be recoverable through forensic techniques, as they often remain on the device's storage until overwritten.

2. How would you acquire the data from the phones?
   Acquiring data from smartphones in a legally sound and forensically viable manner is critical. The process generally involves the following steps:

   • Legal Authority：
     • Search Warrant/Court Order： In most jurisdictions, law enforcement needs a valid search warrant or court order to legally seize and examine a suspect's phone. This document must be specific about what is being searched for and the scope of the search.
   • Seizure and Preservation：
     • Chain of Custody： Maintain a strict chain of custody from the moment the phone is seized. Document who handled it, when, where, and for what purpose.