Code-busters lift RSA keys simply by listening to the noises a computer makes Computer scientists have shown how it might be possible to capture RSA decryption keys using the sounds emitted by a computer while it runs decryption routines. The clever acoustic attack was developed by Adi Shamir (the "S" in RSA) of the Weizmann Institute of Science along with research colleagues Daniel Genkin and Eran …
That's good work on their part. It's really neat, if nothing else.
It doesn't seem like it would be overly hard to prevent though. I know board rooms and other areas, like at some US embassies, have window frames that introduce random frequency and vibration to the windowpanes to prevent laser based audio surveillance. Those systems use the unique sounds created by every central HVAC system as the key for their randomness as it can't be duplicated and filtered out unlike math based randomness generators can (in theory anyway). I don't see why something similar couldn't be introduced in computers, for those who are concerned.
Yes, neat. Easily defeated but impressive to be able to implement it in the real world to begin with.
Laser/windows - I recall an old electronics tutor's tale of the development of that system, when they used a mirror on a sheet of latex for initial lab conditions. They got through a lot of latex, one of the best/easiest/cheapest sources at the time was condoms. Cue some lab junior going to the chemist to ask for a gross of condoms, being asked if he wanted the ones with or without the teat, and responding that he didn't mind as he was going to cut the ends off before using them anyway. One concerned pharmacy assistant.
So in a room full of computers, Plasma TV screens, monitors, microwave oven and a HiFi crunching out electronic music all while living in a basement I assume makes the chaotic computer user harder to listen in to than the guy who owns one computer and one mobile phone?
Which reminds me... I still haven't worked out which device at the front of my house blasts out so much white noise I can't hear MW or LW on my car radio when it is parked outside the door. A little odd as when I use radios in the house it is fine... unless I fire up the Plasma TV.
We used to put an AM radio next to the computer, tuned the radio to an appropriate blank spot on the band, and ran a program that, due to the timing loops and other tricks, would play "stairway to heaven", and other popular tunes of the day.
So now, 40+ years later, some super crypto genius has discovered that if you send a computer known quantities of data you can analyze what it is doing by the EMI it generates.
Next in the news, "round things have less friction than square things", astonishing results of 10 year research project.
Every man and his dog knew of EMI interference and used it for tunes (see also: floppy drive symphonies, dot matrix printers, etc) or to communicate code state when no other output is possible (tight loop for N seconds to leak a debug value, etc). But this "super crypto genius" (you got that right) isn't dealing with EMI from code under his control - this is using real audible sound (coming largely from the power regulator in the laptop dancing around with the likes of Intel SpeedStep and voltage scaling) to extract the complete state from a complex and intentionally hard-to-analyse system. And demonstrated it for real, not just as a thought experiment. Frankly I'd be well chuffed to have pulled that off, and had I been asked if it was possible would have doubtless said "nope".
And as a petty snark on "round things have less friction than square things" notion - just leave your handbrake on and take the car for a quick push along the road... (wheels are good but it's not directly about friction)
"this is using real audible sound (coming largely from the power regulator in the laptop dancing around with the likes of Intel SpeedStep and voltage scaling) to extract the complete state from a complex and intentionally hard-to-analyse system."
Although it is impressive, I wonder how much data is actually being interpreted/interpolated from the samples and how much is linked to a fingerprint database in a similar way to how submarines can detect not just ships or other subs from their engine/screw noises but which make/model/class and sometimes an exact named vessel.
This may not be so much of a technological breakthrough as an advancement and/or application of existing technology and methods to a similar problem.
@LordHighFixer
Perhaps read the paper before pooh-poohing the results; it specifically mentions (3.3) that they ruled out EMI and confirmed the readings were from 'acoustic emanations'.
Beyond just the fun-and-games you mention with EMI, testing for vulnerabilities to EMI side-channel attacks is common enough that there is no way the authors didn't know about this. Indeed, there are even competitions to see who can retrieve keys from chips using EMI analysis.
One of the implications of this work is that a side-channel attack using sound could, potentially, be conducted at distance. They managed 4m with a parabolic reflector but, as the signal is audible, any method that captures audio with sufficient sensitivity should work. In the paper, they indicate that they plan to use a laser vibrometer in future tests!
Other scenarios they describe include bugging/tapping a phone conversation and using a computer's own microphone. The latter would not be overly difficult and would be ideal where someone is using, for example, Skype.
The mature nature of EMI side-channel research means that there are existing measures for protection against such attacks, but machines so protected would still be vulnerable to acoustic analysis, which opens numerous attack vectors, some of which could be very covert.
Of course, it's not just a matter of 'record sounds, get data' but the principle has been proven.
This post has been deleted by its author
Yes, in my teens (Early 80's) repaired core memories, the only ones that had the equipment to do this in the UK. They used to hum tremendously and blow up because of resonance and blown transistors... I seem to remember. Later in 1984 at Broadcasting House, worked on repairing valve ampliers, where the gain was so high, that the valves were microphonic. Now I feel like an even older fart!
Great article though!
East to see some hackers trying this together with a whole arsenal of other vulnerabilities to supplement their hoard of stolen bitcoins, where the value of data gathered is worth LOAD$AMONEY.....again only oldies would understand Harry what-is-name punchline.
Back in the day [70's and 80's] we were coating the inside of plastic CRT terminal covers with SILVER. Uncle Sam knew that you could potentially read the text as it was typed on the display from outside the room.
We offered a cheaper coating (Zink) but that did not satisfy them.
That was something I read about when doing my Msc. The example they gave was modulating electrical signals, but it basically means any connection to the outside world is theoretically a side channel route.
Plus A.Tannenbaum's sarcastic take on passwords ;-)
A publication of A. Shamir is well worth reading...
P.
Seriously - nice job. That is some impressive, impressive work.
As several people have mentioned above, EMI is one thing (and a pretty well known thing) but using coil whine* as a reliable indicator of what functions the CPU is performing and refining that to find a 4096-bit key? Like I said: impressive.
Of course, they then took this further, realising that, as the source of information was seemingly voltage regulation, there should be ways to measure this more directly. In one of their experiments they get the same information from connecting a voltage probe to a CAT5 cable connected to a switch - at the switch end. As they rightly point out, that can be in another room, far from the user's gaze and doesn't actually interrupt use of the network. As the information is coming from the potential of the shield, you don't even need the port to be enabled on the laptop.
Even more amazing is being able to measure this indirectly by measuring the potential of someone touching the laptop chassis!
Again - very, very impressive work and they should be suitably proud of it.
Maybe not directly useful given the restrictions but they have proved a general property - that CPU operations can be reliably ascertained from analysing the voltage regulation.
* - What people call 'coil whine' is not always generated by the coils themselves, as the paper identifies. More generally, it is the power supply/regulation circuits that are responsible. It doesn't seem to matter what is actually responsible, nor that they know what component/circuit it is.
Back in 1985 I worked on an Apollo workstation with a squeaky coil in the power supply. You could hear the squeak change pitch/volume as the load changed (eg. looping etc).
But to recreate keys from that sounds like a stretch, except in highly contrived hardware assembled to support a theory.
Most power supplies etc are very well decoupled from the coils. There are also caches and other loads playing havoc with the load, so it is hard to believe that exact CPU instructions can be determined.
The other part that makes this sound iffy, is that most CPUs are multi-core, executing and GHz. The phone microphone is bandwidth limited to a few kHz. It just does not have the bandwidth to convey the amount of data implied by decoding instructions that fast.
They do it one small part at a time, so the bandwidth of the output channel is not relevant. This is also why there's a requirement that a large number of messages must be decrypted without human intervention and that these messages are crafted in the real time based on previous results.
"Of course, they then took this further, realising that, as the source of information was seemingly voltage regulation, there should be ways to measure this more directly. In one of their experiments they get the same information from connecting a voltage probe to a CAT5 cable connected to a switch - at the switch end."
That's an interesting feat, given that CAT5 cables are UNshileded (being a UTP cable).
All,
I think it is worth pointing out that while 2.x does include blinding schemes to avoid side channel leakage, as of http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html so does gpg 1.4.16, which was added following private contact by one of the researchers.
As for those wondering why it was left out, previously local LAN attacks allowed sidechannel leakage to exploit this but there was no other vector known until this paper. However gpg 1.x isn't designed for such purposes therefore it was left out. Doesn't mean someone did not deploy it incorrectly, but gpg has always been rather conservative.
The private key to be broken can't be password protected because that would mean a human would need to intervene to open every message.
Not exactly true; it's not uncommon to have the private key stored durably in encrypted form, but decrypted on first use after boot and kept in unencrypted form (possibly obscured) in memory while the system is up.
In any case, this is just a special case of the constraint that messages need to be decrypted automatically, and that only because of the volume of messages. It's a pretty meaningless caveat.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
