G 0.14 Espionage (Information gathering)

Espionage refers to attacks aimed at collecting, evaluating and processing information about companies, people, products or other target objects. The processed information can then be used, for example, to provide another company with certain competitive advantages, to blackmail people or to reverse engineer a product.

Alongside many technically complex attacks, there are often much simpler methods of obtaining valuable information, for example by combining information from multiple publicly accessible sources that individually appear innocuous but in other contexts can be compromising. Since confidential data is often not adequately protected, it can often be disclosed through optical, acoustic or electronic means.

Examples:

• Many IT systems are protected against unauthorized use by identification and authentication mechanisms, such as account name and password verification. However, if the password is sent unencrypted over the line, it may be possible to intercept it.
• To withdraw money from an ATM, the correct PIN for the debit or credit card used must be entered. Unfortunately, the privacy protection on these devices is often inadequate, so attackers can easily look over customers’ shoulders while they enter their PIN. If attackers subsequently steal the card, they can drain the account.
• To gain access rights on a PC or manipulate it in other ways, attackers can send users a Trojan horse, which they have attached to an email as a supposedly useful program. In addition to direct damage, a wide variety of information can be espied through Trojan horses, not just about the individual computer but also about the local network. In particular, many Trojan horses aim to steal passwords or other login credentials.
• In many offices, workplaces are not acoustically well insulated from each other. As a result, other employees and visitors may be able to overhear conversations and thereby gain knowledge of information that is not intended for them or is even confidential.