BSI ID: G 0.21

Manipulation refers to any form of deliberate but covert intervention to change target objects of any kind without being noticed. Manipulation of hardware or software may be carried out out of a desire for revenge, to cause damage deliberately, to gain personal advantages or for financial gain. The focus may be on devices of all kinds, accessories, data carriers (e.g. DVDs, USB sticks), applications, databases or similar. Manipulation of hardware and software does not always result in immediate damage. However, if the information processed by the hardware or software is compromised, this can have all kinds of security implications (loss of confidentiality, integrity or availability). The later the manipulation is discovered, the more extensive the perpetrator's knowledge is and the more profound the impact on a work process, the more effective the manipulation can be. The effects range from unauthorised access to sensitive data to the destruction of data carriers or IT systems. Manipulation can also result in significant downtime.

Examples:

• At a Swiss financial company, an employee manipulated the application software for certain financial services. This enabled him to illegally obtain large sums of money.

• By manipulating ATMs, attackers have repeatedly succeeded in illegally reading data stored on payment cards. In conjunction with PINs that had been spied out, this data was then misused to withdraw money at the expense of the cardholders.