T 5.125 Unauthorised transfer of data using portable terminal devices

Portable terminal devices such as notebooks or PDAs are generally designed to allow easy exchange of data with other IT systems. This may be performed using a connecting cable or wirelessly, e.g. using infrared, Bluetooth, or GSM.

Information may be retrieved and transferred unobtrusively where open access to IT systems is possible. The collected data can then be stolen or modified inconspicuously with the help of the portable terminal device. Subsequent checks or proofs are not always possible, since the accesses are often not logged correspondingly.

If the device is equipped with a wireless communication interface (for example an integrated WLAN card or a Bluetooth interface to a mobile phone), the stored information may also be transferred directly to any location in the world (see also T 5.97 Unauthorised transfer of data over mobile phones).

If a separate wireless network (WLAN) is operated in an organisation, a visitor may eavesdrop on the WLAN traffic using his/her portable PDA. If the wireless network is not sufficiently secured, the attacker may "copy" all transferred data without any problems or even gain direct access to the network this way.

Example:

• An employee of a company is called out of a meeting with an external person in order to answer an important phone call. The external person uses the short time he/she is unattended in order to connect the PC installed in the meeting room to his/her portable terminal device. Then, he/she transfers all accessible data to his/her portable terminal device.