In my opinion, changing software in response to emissions (be it audio or EMI/RFI) and power side-channel attacks is mostly futile and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks.
On the other hand timing attacks are something that anyone implementing anything security related has to be aware of and actively prevent as they can be conducted from mostly anywhere.
On the other hand measurement of potential on chassis seems interesting as that can possibly be measured pretty far away (eg. PC -> STP cable -> Cable modem -> CATV).
Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks
Comments
In my opinion, changing software in response to emissions (be it audio or EMI/RFI) and power side-channel attacks is mostly futile and correct solution involves just making sure by means of physical security and/or shielding that attacker cannot access places where it's possible to implement such attacks.
On the other hand timing attacks are something that anyone implementing anything security related has to be aware of and actively prevent as they can be conducted from mostly anywhere.
On the other hand measurement of potential on chassis seems interesting as that can possibly be measured pretty far away (eg. PC -> STP cable -> Cable modem -> CATV).
Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
[1] https://en.wikipedia.org/wiki/Maginot_Line
[2] well, as many as economically feasible anyway.
This is addressed in the linked page.