Definition
An attack technique that repeats tiny, small-value manipulations to collect an accumulated gain for an unjust profit
Visual IT Encyclopedia › Information Security › Application Security
Visual IT Encyclopedia › Information Security › Application Security
Definition
An attack technique that repeats tiny, small-value manipulations to collect an accumulated gain for an unjust profit
Setup: the bank works out interest to a hundredth of a cent but pays accounts only in whole cents. The leftover fraction of a cent is not paid to the customer; it stays in the bank's own ledger. There are six customers.
Bank interest program
Before: the leftover stays in the bank's ledger
Slipped-in line: send the leftover to the attacker
Now processing
-
Calculated interest
-
-
To the customer
-
To the attacker
Collected in the attacker's account
$0.0000
Skimmed from one customer in a year
About $0.06
Collected a year from 10 million customers
About $600,000
Assumes interest is paid once a month, 12 times a year
0 / 6
Salami Technique
The salami technique takes amounts too small for anyone to notice from many accounts or transactions and collects them in one place. Here it skims the fraction of a cent left over when each customer's interest is calculated. Each slice is less than a cent, but across many customers, month after month, it adds up to a lot of money.
Example: slice a salami thinly enough, and no one notices that one slice is gone.