I was asked during a job interview the following question, to which I couldn't find an answer then, and this thing is still bothering me. I was hoping someone might know the answer here:
Consider two banks that communicate through an encrypted channel, where you are able to listen to the communication between them:
Bank A holds credit card numbers (you can refer to the credit card numbers as decimal or binary number of some length of your choice - it doesn't matter) in its database, in a plain form; meaning the credit card numbers are not encrypted at rest - they are encrypted only right before they are sent to Bank B through the channel between them.
The goal is to steal Bank A's credit card numbers. But, as I mentioned, since you are listening to an encrypted channel, we suppose you somehow gained access to Bank A's database, where it holds its credit card numbers, and you are given a chance to plug your disk on key into it, and modify the data in the database.
So basically the question comes down to: Is there any data you can add to the database, or any manipulation you can do on the credit card numbers, that will then give you the ability to figure out the numbers by listening to the encrypted channel, or to provide any advantage in attempting to decrypt the credit card?
(Thanks to Xander for helping with overcome the language barrier by rephrasing the question, I'm not an English speaker)
I hope I didn't omit any important details (I should've write that down). Is it doable?
dok
? – Abe Miessler Sep 5 '14 at 21:55...suppose that you somehow gained access to Bank A's database, ...and run any code you'd like on it....
is correct, then I would just query the credit card table. – Abe Miessler Sep 5 '14 at 21:58