Side-Channels: The Cyber Risks of Off-Line Leaks

Side-Channels: The Cyber Risks of Off-Line Leaks
1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

According to a research by a Georgia Tech team presented December 15 at the 47th Annual IEEE/ACM International Symposium on Microarchitecture in Cambridge, U.K., “Side-channel signals emitted by computers and cellphones could provide hackers with another way to see what the devices are doing. By analyzing the low-power electronic signals emitted by these devices – even when they’re not transmitting on the Internet or cellular networks – hackers can obtain information about computer operations and even track passwords. And smartphones may be even more vulnerable to such spying.”

“Researchers at the Georgia Institute of Technology are investigating where these information “leaks” originate so they can help hardware and software designers develop strategies to plug them. By studying emissions from multiple computers, the researchers have developed a metric for measuring the strength of the leaks – known technically as “side-channel signal” – to help prioritize security efforts.

“People are focused on security for the Internet and on the wireless communication side, but we are concerned with what can be learned from your computer without it intentionally sending anything,” said Alenka Zajic, an assistant professor in Georgia Tech’s School of Electrical and Computer Engineering. “Even if you have the Internet connection disabled, you are still emanating information that somebody could use to attack your computer or smartphone.”

“Side-channel emissions can be measured several feet away from an operating computer using a variety of spying methods. Electromagnetic emissions can be received using antennas hidden in a briefcase, for instance. Acoustic emissions – sounds produced by electronic components such as capacitors – can be picked up by microphones hidden beneath tables. Information on power fluctuations, which can help hackers determine what the computer is doing, can be measured by fake battery chargers plugged into power outlets adjacent to a laptop’s power converter.

Some signals can be picked up by a simple AM/FM radio, while others require more sophisticated spectrum analyzers.  And computer components such as voltage regulators produce emissions that can carry signals produced elsewhere in the laptop.

As a demonstration, Zajic typed a simulated password on one laptop that was not connected to the Internet. On the other side of a wall, a colleague using another disconnected laptop read the password as it was being typed by intercepting side-channel signals produced by the first laptop’s keyboard software, which had been modified to make the characters easier to identify.”

“There is nothing added in the code to raise suspicion,” said Milos Prvulovic, an associate professor in the Georgia Tech School of Computer Science. “It looks like a correct, but not terribly efficient version of normal keyboard driver software. And in several applications, such as normal spell-checking, grammar-checking and display-updating, the existing software is sufficient for a successful attack.”

Currently, there is no mention in the open literature of hackers using side-channel attacks, but the researchers believe it’s only a matter of time before that happens. The potential risks of side-channel emissions have been reported over the years, but not at the level of detail being studied by the Georgia Tech researchers.”

Source: Georgia Tech News Center
Photo Credits: 105/365 – Spectrum Analyzer by SuperToy / FlickR