Kleptographic attacks – the dark side of cryptography

Cryptography has become a fundamental tool ensuring secure data exchange in the TCP/IP environment. Without protocols such as SSL, it is difficult to imagine most commercial data exchange applications in such systems. Cryptography-based solutions are a cheap and effective alternative to classic, “physical” protection methods. However, it turns out that there is also a “dark side of the force” for cryptography – cryptographic methods can be used in a perfidious way against their user. One of the most sophisticated methods is so-called kleptography, invented by Adam Young from Microsoft Research and Moti Yung from Columbia University. The problem of protecting data stored in a company or institution’s computer system against unauthorized transfer to the outside is gaining increasing importance. The availability of communication protocols, the number of people with access to data, and finally the possibility of independent action by spyware – all this makes the problem difficult to solve. The possibility of unauthorized data transfer by employees is limited by appropriate security policy provisions. The ability to use SSH and SCP protocols for accessing computers outside the corporate network, using encryption programs, attaching encrypted files to emails, and using central mail servers for corporations with automatic content control are being reduced.