Playing loud music when encrypting/decrypting/typing in your password will defend against acoustic attacks, right?
This other type of attack, however, isn't so easily guarded against:
Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.
This serves as a reminder that it's pretty much impossible to defend against an attacker that has physical access to your box.
Playing loud music when encrypting/decrypting/typing in your password will defend against acoustic attacks, right?
Probably. The answer to Q11 says "The interesting acoustic signals are mostly above 10KHz". They don't say what the high end of the range is. But I would guess that sufficiently loud music (which usually contains frequencies up to about 22kHz) would mask the sound generated by the CPU.
Noisy environment. One may expect that placing the machine in a noisy machine will foil the attack.
However, the energy of noise generated in a typical noisy environment (such as outdoors or a noisy room)
is typically concentrated at low frequencies, below 10kHz. Since the acoustic leakage is usually present
well above this rage, such noises can be easily filtered out during the data acquisition process using a
suitable high-pass filter (as we did in our experiments). Also, the signal would be observe during any
pauses in ambient noise (e.g., music). Note also that the attacker may, to some extent, spectrally shift
the acoustic signal to a convenient notch in the noise profile, by inducing other load on the machine (see
below). Thus, a carefully-designed acoustic noise generator would be required for masking the leakage.
@kevincennis: A counter-argument to that is that an attacker could run shazam/soundcloud to fingerprint the music, and then subtract the music from the recorded signal. It would be more work, certainly, but I don't think e.g. just playing the radio would be enough to mask the side-channel.
Filtering out a signal that's in the same band is notoriously difficult.
If the signal you're subtracting is known to you, you can simply lock the phases and subtract. That's pretty trivial.
But knowing the name of the song doesn't necessarily give you a known signal to subtract. Conceivably, you could be working with a version of the song that was compressed differently than the one playing on the target computer. In which case, the two signals might not have the same waveform, and they wouldn't cancel.
To the listener's ear, the signals may sound identical. A good example of this principle is musical instruments. Have a skilled violinist play the same note twice with the same articulation for the same duration under the same conditions. Record each sample the same way. Most listeners would say these two samples are identical. But if you invert one and then mix them, they won't cancel, because they didn't actually have the same waveform.
But it's definitely an interesting approach, and potentially viable, if a good filtering algorithm can be worked out. My suspicion is that such an algorithm exists or is at least possible. But I'm not an audio engineer, so I'm not certain.
I suspect that, in practice, playing music will provide enough of a barrier to mitigate attacks using these side-channels. But then again, in practice, I'd hope that attacks using these side-channels are pretty infrequent to begin with.
Besides, in practice, upgrading to GnuPG 1.4.16 (released today) is supposed to also mitigate the key extraction attack using this side channel.
The naive approach I suggested would be easily defeated by playing two songs from two different sources; which itself would be defeated by setting up soundcloud on two devices in both places and carefully setting up/analyzing/modelling the room so that you can adjust the signal you're subtracting to account for the distance the sound waves travel and whatnot. I think after a while you just get increasing complexity and diminishing returns -- i.e. it becomes an arms race.
Certainly you also can't assume that a recording of a sound played via crappy laptop speakers will even closely resemble the original waveform. Playing back (distortion by differing air pressure etc) and recording (environment & A/D noise anyone?) will completely distort it.
That's a really interesting point. I hadn't thought about phase cancellation at all. You certainly couldn't remove everything, since the signal you picked up would be influenced by the speakers/room/microphone/converters/etc, but you still might be able to remove a significant portion of the music that way.
I believe this would only mask the direct sound waves, not the reflections caused by the room. Perhaps masking the direct sound is enough, but maybe not if the reflections have sufficient energy.
If you've got enough information to cancel the main signal, then you've also got enough information to cancel the reflections. It will take a more computational power though, which is okay if you're doing the analysis on a recording.
The brute force way is to do an exhaustive search, repeatedly correlating the signal you are looking to cancel and the received signal, whilst "sliding" the known signal across the received signal, which means adding a delay to the known signal between each correlation. Correlation peaks can be picked out and used to cancel the reflections. Similar techniques are regularly used in radio communications, to combat multipath fading, which is a fancy way of saying that the received radio signal contains reflections.
I saw that too, but I think they sort of side-step the issue of music. The bit about noise typically being below 10kHz doesn't really apply to most music. If you go run pretty much any modern record through a spectrum analyser, you'll see tons of content above 10kHz.
Anyway, I'm certainly not claiming to know with any certainty that loud music would work as a preventative measure against this kind of attack. I just don't think the paper sufficiently proves that it wouldn't be.
This is complicated by the human ear's variation in loudness perception over the frequency spectrum, and the effect this has on music. The stuff over 10k is typically mixed quieter than the stuff under 10k, though it doesn't sound that way. Records with lots of energy above 12-13khz tend to sound pretty awful.
Well, by Bradley Manning's account, he listened to Lady Gaga while leaking classified military documents, so maybe hit pop songs are not as innocent as they seem. :)
In my opinion, changing software in response to emissions (be it audio or EMI/RFI) and power side-channel attacks is mostly futile and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks.
On the other hand timing attacks are something that anyone implementing anything security related has to be aware of and actively prevent as they can be conducted from mostly anywhere.
On the other hand measurement of potential on chassis seems interesting as that can possibly be measured pretty far away (eg. PC -> STP cable -> Cable modem -> CATV).
Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks
The attack requires the victim to encrypt/decrypt many chosen messages, no? Configure your laptop to only encrypt or decrypt messages when you want it to.
Not if the attacker doesn't control the contents. They would need to send you the email, and then you would need to open/decrypt it while they're listening. afaik.
Uhh... When people say physical access to your box, they mean someone can physically tamper with it in arbitrary ways. This is not the same as being near the box. Otherwise we would just say that all phones/laptops are insecure.
Comments
Playing loud music when encrypting/decrypting/typing in your password will defend against acoustic attacks, right?
This other type of attack, however, isn't so easily guarded against:
Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.
This serves as a reminder that it's pretty much impossible to defend against an attacker that has physical access to your box.
Probably. The answer to Q11 says "The interesting acoustic signals are mostly above 10KHz". They don't say what the high end of the range is. But I would guess that sufficiently loud music (which usually contains frequencies up to about 22kHz) would mask the sound generated by the CPU.
From the article:
"Thus, a carefully-designed acoustic noise generator would be required for masking the leakage."
Like dubstep.
EDM to save the world (by blocking government snooping)!
http://www.youtube.com/watch?v=Da4V5vKcGl8
They have an electribe ER1 and they modulate so that's gold.
of COURSE we can f@cking modulate this
@kevincennis: A counter-argument to that is that an attacker could run shazam/soundcloud to fingerprint the music, and then subtract the music from the recorded signal. It would be more work, certainly, but I don't think e.g. just playing the radio would be enough to mask the side-channel.
Filtering out a signal that's in the same band is notoriously difficult.
If the signal you're subtracting is known to you, you can simply lock the phases and subtract. That's pretty trivial.
But knowing the name of the song doesn't necessarily give you a known signal to subtract. Conceivably, you could be working with a version of the song that was compressed differently than the one playing on the target computer. In which case, the two signals might not have the same waveform, and they wouldn't cancel.
To the listener's ear, the signals may sound identical. A good example of this principle is musical instruments. Have a skilled violinist play the same note twice with the same articulation for the same duration under the same conditions. Record each sample the same way. Most listeners would say these two samples are identical. But if you invert one and then mix them, they won't cancel, because they didn't actually have the same waveform.
But it's definitely an interesting approach, and potentially viable, if a good filtering algorithm can be worked out. My suspicion is that such an algorithm exists or is at least possible. But I'm not an audio engineer, so I'm not certain.
I suspect that, in practice, playing music will provide enough of a barrier to mitigate attacks using these side-channels. But then again, in practice, I'd hope that attacks using these side-channels are pretty infrequent to begin with.
Besides, in practice, upgrading to GnuPG 1.4.16 (released today) is supposed to also mitigate the key extraction attack using this side channel.
The naive approach I suggested would be easily defeated by playing two songs from two different sources; which itself would be defeated by setting up soundcloud on two devices in both places and carefully setting up/analyzing/modelling the room so that you can adjust the signal you're subtracting to account for the distance the sound waves travel and whatnot. I think after a while you just get increasing complexity and diminishing returns -- i.e. it becomes an arms race.
Certainly you also can't assume that a recording of a sound played via crappy laptop speakers will even closely resemble the original waveform. Playing back (distortion by differing air pressure etc) and recording (environment & A/D noise anyone?) will completely distort it.
That's a really interesting point. I hadn't thought about phase cancellation at all. You certainly couldn't remove everything, since the signal you picked up would be influenced by the speakers/room/microphone/converters/etc, but you still might be able to remove a significant portion of the music that way.
I believe this would only mask the direct sound waves, not the reflections caused by the room. Perhaps masking the direct sound is enough, but maybe not if the reflections have sufficient energy.
If you've got enough information to cancel the main signal, then you've also got enough information to cancel the reflections. It will take a more computational power though, which is okay if you're doing the analysis on a recording.
The brute force way is to do an exhaustive search, repeatedly correlating the signal you are looking to cancel and the received signal, whilst "sliding" the known signal across the received signal, which means adding a delay to the known signal between each correlation. Correlation peaks can be picked out and used to cancel the reflections. Similar techniques are regularly used in radio communications, to combat multipath fading, which is a fancy way of saying that the received radio signal contains reflections.
Edit: remove cruft at end of comment.
I saw that too, but I think they sort of side-step the issue of music. The bit about noise typically being below 10kHz doesn't really apply to most music. If you go run pretty much any modern record through a spectrum analyser, you'll see tons of content above 10kHz.
Anyway, I'm certainly not claiming to know with any certainty that loud music would work as a preventative measure against this kind of attack. I just don't think the paper sufficiently proves that it wouldn't be.
This is complicated by the human ear's variation in loudness perception over the frequency spectrum, and the effect this has on music. The stuff over 10k is typically mixed quieter than the stuff under 10k, though it doesn't sound that way. Records with lots of energy above 12-13khz tend to sound pretty awful.
https://en.wikipedia.org/wiki/Equal-loudness_contours
EDIT: also pitch is logarithmic with respect to frequency. 8khz sounds really high pitched.
But laptop speakers are notoriously shitty. I don't think laptop speaker output has tons of content above 10kHz.
Playing loud music when encrypting/decrypting/typing in your password will defend against acoustic attacks, right?
I recommend "Wrecking Ball" by Miley Cyrus. The strength of the attacker's cryptanalysis will be moot because no one will go near you.
"Puberty Love" can be an ... um ... lethal option, too.
http://en.wikipedia.org/wiki/Attack_of_the_Killer_Tomatoes
or... it may increase people's interest in you, you know, for national security.
Well, by Bradley Manning's account, he listened to Lady Gaga while leaking classified military documents, so maybe hit pop songs are not as innocent as they seem. :)
In my opinion, changing software in response to emissions (be it audio or EMI/RFI) and power side-channel attacks is mostly futile and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks.
On the other hand timing attacks are something that anyone implementing anything security related has to be aware of and actively prevent as they can be conducted from mostly anywhere.
On the other hand measurement of potential on chassis seems interesting as that can possibly be measured pretty far away (eg. PC -> STP cable -> Cable modem -> CATV).
Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
[1] https://en.wikipedia.org/wiki/Maginot_Line
[2] well, as many as economically feasible anyway.
This is addressed in the linked page.
The attack requires the victim to encrypt/decrypt many chosen messages, no? Configure your laptop to only encrypt or decrypt messages when you want it to.
Some people have GPG configured to sign every email they send. Would that be enough activity to compromise the key?
Not if the attacker doesn't control the contents. They would need to send you the email, and then you would need to open/decrypt it while they're listening. afaik.
This serves as a reminder that it's pretty much impossible to defend against an attacker that has physical access to your box.
... or is able to hack into your phone.
So a scenario would be what, when two people bring their laptops to do a deal via Bitcoin?
It won't - you find the tracks with shazam and then just subtract them from the recording.
Uhh... When people say physical access to your box, they mean someone can physically tamper with it in arbitrary ways. This is not the same as being near the box. Otherwise we would just say that all phones/laptops are insecure.