Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
Comments
Ah, the Maginot Line[1] argument. Given the sheer number of possible emissions channels, are you proposing they all be universally protected against in hardware? Or that there should be special classes of 'protected against $FOO' hardware for specific threats?
The concept of defence-in-depth suggests that you should take all[2] possible measures to avoid sensitive data leakage. If an attacker does get into your secret computer-bunker, but can't get past the cage or case-level defences, they could potentially still use such an attack as this. Also, how do you test that your shielding is working? The paper notes that their probable noise source was a faulty electrolytic capacitor, which presumably wasn't [as] faulty when QA'd at the factory. So you'd need to periodically retest, which could get pricey fast.
Likewise, the engineering tradeoffs of shielding everything make it pretty impractical for mobile/portable devices, or ones that might be used in unsecured areas.
The main issue I see is that if this (or similar improvements) is truly something that could be implemented with a mobile phone or small MEMS microphone bug in the general vicinity, it's potentially cheap enough to make it not just a "how do I protect against the NSA?" problem, but one within the means of corporate or organised crime espionage groups.
[1] https://en.wikipedia.org/wiki/Maginot_Line
[2] well, as many as economically feasible anyway.