Slashdot Mirror
Breaking RSA Keys by Listening to Your Computer
An anonymous reader writes "Adi Shamir and crew gave a talk on preliminary results in extracting a private RSA key
just by listening to the computer!. Similar to power analysis and LED leakage, this is a non-invasive, side channel attack that may have applications to tamper-resistant systems. It appears to be related to noisy capacitors on the motherboard, an effect which has been observed when CPU power saving is enabled on laptops."
No power saving for me! My encrypted porn is far too important.
I wonder if the FBI had a chat with him.
The following demonstrates some preliminary results in the analysis of acoustic emanations from personal computers, showing them to be a surprisingly rich source of information on CPU activity.
Does it mean that people can get my private key by actually "listening" to my box? It would be great if anyone can provide more information regarding this. It's kinda freaky!!!
I have a 2.4ghz Pentium 4b on an Asus P4B266 motherboard. Hearing my capacitors buzzing and sinking when the processor is under full load is comforting because I can tell if there is some kind of process hogging my load. Unfortunately, it is extremely annoying after a while, but I don't want to spend the money to get a new motherboard. :(
I am defenseless. Use your button. Mod me down with all of your hatred.
I've got so many fans running in my computer that you can't even hold a conversation in the same room, much less listen for capacitors
Wouldn't it just be easier to use money/women/men/donkeys to bribe the person to cough up a password?
I guess you could always "bug" a place, but if you were significantly paranoid about security(to the point where someone would try to listen your key away from you) wouldn't you have a copper cage around your building?
The article does not deal with actually computing the encoding (Pe) and decoding functions (Pd) for q,n,d. Where q,n are unique primes. The only thing their interference spotted is the markings between computing each function for the signature, and this drastically varies based on the machine. They do have a Proof of Conept, but no quantifiable data.
My $0.02.
artlu
-------
artlu.net
Investigations are an important part of the justice system. Though the tenet is "innocent until proven guilty", it's only possible to prove someone guilty by means of an investigation.
By encrypting your data, you are bringing unnecessary suspicion upon yourself. I wouldn't be surprised if the FBI's powers are enhanced to include surveillance of you and your data.
I have been pwned because my
schmuck
Does anyone know the range of how far you can be away from the computer to hear the sounds? The proof-of-concept website just seemed to be "look, here are pictures of computer operations... in sound! Yay!" without enlightening us on any details.
the wont be able to hear it if you've got one of these
I'd never use SHA-1/RSA for digital signature.
Nope, for it's DSA/DSS all the way, and all the noisy capacitors in the world won't help you break it.
Why do I trust it? Because it was developed by the NSA, not a bunch left leaning MIT eggheads.
That damn 666 CPU....
There you have it, the EVIL bit at work....
Twenty years ago at Bell Labs one of the speech machines (an SEL with homebrew audio i/o) had output to loudspeakers that went through unshielded speaker wires that ran past the CPU, so if you weren't playing anything back the speakers played back CPU noise. We could tell what stage a compilation was at by the noise that came over the speakers.
Now I have an excuse to play loud music at work: security!
"...For example, a high-quality analog equalizer can be used to attenuate strong low-frequency fan hums and background noise..."
taken from the article.
you'd need background noise in the same frequency area (dummy CPU ?)
at best, they have shown that they can detect differences in the types of instructions the processor is executing by listening to the sounds of the capacitors. It is a long way from there to the point where they can extract the key itself from the information. In fact, I would venture that the data is far too noisy (haha) for any significant part of the key to ever be extracted, reagardless of the amount of computational power thrown at the problem. What they might be able to do however is use the information gleaned to eliminate large swaths of the set of possible keys. This could make cracking the key by conventional means a computationally easier task.
So, in all, this paper is not insignificant, but it's also not a reason to completely give up on security or to install a cone of silence around your computer.
lysergically yours
they're not making this up - on my laptop i can hear the noisy capacitors when the harddrive has spun down and the CPU is in energy-saving mode.
As much as this technology is a risk and therefore a potential threat, unless you are of the reaslly paranoid (which would mean this interests you considerably) there are far easier ways of attacking a computer.
:)
This attack came to show how to attack the key, which is why it interests these folks, I suppose, but it would be much easier to use TEMPEST if you get access to actually install some tool to hear && (record || trasmit) the audio.
I would suggest TEMPEST would also be more reliable, but some testing is in order, as well as a lot of research for every CPU you intend to attack.
Cost vs. benfit? I can't really see it.
This is pretty cool though!!
(adding another mark on my paranoia list).
Dude, atleast use the proper syntax.
What a ridiculous load of bunk. You cannot possibly use audio frequencies to infer any meaningful information about what's happening on a processor running at 1,000 MHz or higher clock speeds. Repetitive sampling techniques would be necessary, and I don't think anyone's key-generation algorithm is going to sit in a tight loop, doing the exact calculations over and over for the weeks of wall-clock time it would take to sample any actual key data by acoustical means.
All this article "proves" is that a CPU's current drain is vaguely correlated to the type of instructions it's executing. In a modern multitasking OS, that's not even a useful basis for traffic analysis.
Even if the FBI/NSA can't manage to decode your data, the fact remains if they get to look at your HD via a warrent and they discover 20 GB of encrypted data rather than anything readable, they know you're hiding something from their view.
That discovery encrypted data can still be used as evidence in justifying further warrants... while discovering 20 GB of Britney Spears music in readable form would most likely cause the investigation to give up on worrying about the contents of that hard drive.
If you go to the site of the DPA attack,Cryptographic Research, you can see that they have already have patents on Systems to protect against these kind of attacks. So it's not like they have developed anything (I don't know if they have) but you can already pay them to get protection from this kind of attack! yay!
This sounds kinda like that crack that the college student found in 1995 dealing with the speed of the CPU determining what random numbers the host would pick. A good reason not to keep your CPU info in the HINFO line of a DNS zone file.
Small nit-pick: presumed innocent until proven guilty.
Even at a 96 kHz sampling rate, the maximum frequency that can be sampled is 44 kHz. How could one hope to extract a certain few bits from a recording when the CPU's instruction throughput is many times that? Most of the information that would need to be examined wouldn't make it onto the recording. Correct me if I'm wrong, but it seems Nyquist leaves this idea dead in the water.
...but all I heard was "Dave, what are you doing Dave?"
Hmm, maybe I should put away the screwdriver.
Encryption inhibits surveillance by ANYONE. That the government falls under the category of anyone is secondary to most encryption desires and uses.
If someone was attempting avoidence/prevention of potential government investigation, then the act of encrypting wouldn't make it more or less likely. They make use of encryption because they have some information they don't want the government to know. It's not because they use encryption but due to any relevant knowledge they have, that a person should ellicit investigation by their government. And then knowledge pertaining only to those things that governments should worry about (murder, fraud, and other criminal acts).
So by encrypting the code on my laptop as a security precaution, you're saying I bring unnecessary suspicion upon myself? Noone but my company and its business competitors has an interest in the trade secrets I manage and create during the course of my business. Therefore I use encryption as a means of self-defense. I inhibit investigation by those not authorized by me or my company. The act of investigation could very well be illegal. I would not give my government blanket access to my trade secrets, when I have no control over what they do with them. They should have no interest in them. in fact, by wanting to enhance surveillance of those things which they declare to not have an interest in and would normally have no involvement in is suspicious in itself. Encryption is a tool and is about as dangerous as a screwdriver.
click-clack, front and back. I'm not moving this car otherwise.
Obviously this attack requires physical access to the machine. And with physical access to the machine there are easier ways to extract keys. So this is really only relevant if you want to protect against somebody with physical access, that wouldn't perform a simpler attack, which could involve disassembling the machine. I think some chipcards you would use to protect keys is a case, where you might worry about such attacks. But how much noise does a chipcard produce, I think with those it would make more sense to meassure the power consumption. Where are the other cases, where you really need to worry about this?
Do you care about the security of your wireless mouse?
Eavesdropping is an old technique, it's interesting that it's being touted as something new. Okay so the context is a bit different but not all that different. Is even the context all that new? It may be new to the authors (and readers?) but it's probably not new to those folks that employ creative techniques to snoop. A microphone works great to "log" keystrokes. The delays between key presses can be used to create a pattern that in turn can define exactly what's been typed. Passive listening devices have been employed for years, sometimes going undetected for years. A cell phone could turn into a monitoring device. So there really appears to be no such thing as a secret afterall. Where's my quantum encryption...?
http://tinyurl.com/3t236
When I listen to my computer, it just tells me "Snap, crackle, burn!"
Generic message here.
$
It tells me to troll Slashdot, and buy Kenny G albums.
I'm starting to think it doesn't have my best interests at heart...
using namespace slashdot;
troll::post();
Anyone who uses software powersaving/CPU cooling in windows or linux has heard this noise. Programs like CPUIdle et all put the processor into an HLT state and cool it significantly (12+ degrees here). I run the thing to cool my massive laptop which would get quite hot during renders and things, what with it's 10K RAID etc.. I hear this hum in a lot of electronics that have no moving parts (routers, computers, etc..), and have always wondered about it. In a chat on IRC we chalked it up to electric frequency vibration.
I have also worked on some PCs that make the hum during *any* processor use, like scrolling a webpage, etc..
Shamir, once again pointing out something absolutely brilliant and (in retrospect) totally obvious, did forget to include something rather important in his announcement:
The particular pattern of CPU operations executed while an RSA private key is executed varies depending on that RSA private key. Given a rough estimate of the pattern of CPU operations executed, the set of possible RSA private keys is greatly reduced. So it becomes much, much easier -- possibly trivial, particularly if you have a chosen plaintext scenario -- to extract a private key from an otherwise secure system. Consider an e-voting machine with an audio system for handicapped access -- with nothing but a very sensitive microphone in the booth, you might be able to determine the private key used to sign votes (and thus gain the capability to spoof votes elsewhere).
And of course, this would be a very, very successful attack against an RSA private key embedded within a trusted computing environment. Processors -- even those encased in epoxy -- still need power, and variable amounts depending on what they're doing. The brilliance here is that rather than needing some very expensive analog energy drain measurement equipment, you just need a sound card. It's a side channel attack for the masses.
Very very cool work. Wow.
--Dan
If you really want to do some acoustic evesdropping, listen to the keyboard. It's got a much larger signal to begin with (from across the room, instead of having to paste your ear to the computer case.) Since there are always slight mechanical differences between keys on any given keyboard, I would think that the sound spectrum would also be slightly different. Being able to always listen in on the same user would also help, since most people are somewhat consistent regarding which finger they use on which key. (Evesdropping on people who were smart enough to take a touch-typing class in high school is also a big plus.)
Assuming you could discern between the acoustic fingerprint of 100 different keys, then it's just a matter of figuring out which sound goes with which key. It's a simple substitution cypher, which are almost trivial to break.
Sneak your cell phone into your boss's office, set it to silent mode and plug in a headset so that you can set it to auto-answer when a call comes in. Then, while your boss is busy typing dirty notes to his mistress, you call your cell phone, start recording it, and presto, you've got a keylogger without ever having touch his computer or the software on it. Then, at your next performance review, you convince him to give you a hefty raise.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I've heard of Tempest emanations/ Van Ecks for eavesdropping. Supposedly the technique can grab keystrokes from remote machies. Just google for "tempest eavesdropping" if you want info on this.
So the logical thing to do is make the encrypted files play like MP3s of Britany or MC Hammer and it's perfectly safe.
As long as you never accidentally press "Play" that is.
I remember Adi Shamir talked about this at his talk at Carnegie Mellon in March. He gave a brief description and said that it was in the works. So many people doubted it.
pfft
Colin Dean Go a year without DRM
By encrypting your data, you are bringing unnecessary suspicion upon yourself. I wouldn't be surprised if the FBI's powers are enhanced to include surveillance of you and your data.
Using your logic you would approve of the old KGB or the FBI's COINTELPRO tactics. On the same vein I guess we should just do a BCS on every airline passenger and stuff'em into an orange jumpsuit to guard against another 9/11 hijacking. What you are advocating is a "prison state". By your words you want to remove the following from the US Constitution:
Thankfully in 1215 we got the Magna Carta to protect us from tyrants like you.My great-grandfather, who was killed by Mussolini fighting to save his country, is spinning in his grave.
Well, maybe, just maybe, I wanted info about theories of how far you could actually be away from the laptop to retrieve the sounds, or the type of room the laptop was placed in that would provide the most opportune moment for capturing the sounds. Maybe I wanted to know how degraded the results could be in order to get the info about the processing. Maybe you should just crawl back into your cave, AC.
To say that encrypting one's files is automatically suspicious is neither tyrannical nor idiotic. It is absolutely based in reality.
The fact of the matter is that one typically needs a valid reason to use encryption. One also needs a valid reason to buy several hundred pounds of fertilizer. It is the FBI's responsibility to investigate such strange behavior and determine whether the action taken appears legitimate or nefarious.
No one is guilty in an investigation. However, the appearance of guilt is engendered when one acts like a paranoid, anti-government loon.
R = Ron Rivest
S = Adi Shamir
A = Len Adleman
Uh, no. Your analysis runs contrary to cryptanalytic principles and the history of these sorts of attacks.
If you spot me 1 bit of key information, you have by definition halved the work for an attack. In this specific analysis, I need only consider those settings of key bits (in this case, bits of p and q) that correspond to observed behavior for an interval of the spectogram. This means that I can potentially crack the key in time almost linear in the size of the key, rather than completely exponential.
The work on timing attacks and power attacks uses very similar sorts of information, and the anlysis used here will likely be similar also. This is why Shamir, who is certainly qualified to evaluate the work at this point, describes it as "proof of concept": it would be surprising if the observed information fails to extend to a practical attack. It's just that in science, you publish when you have anything interesting to report, so that folks know you got there first.
given a good enogh mic i'm sure it would be easier to plant one of these near a computer than actually breaking into the coputer itself.
I've got 3 computers running side by side good luck figuring out which computer the noise came from.
course you could always install an old hard drive that clicks everytime it's accessed that should cover up the noise pretty well.
I wonder if this technique could be used on console gaming systems like the XBOX?
Also, how about the proprietary circuit boards in automobiles?
Perhaps someone more familiar with this could elaborate or expound?
Thanks!
/me sips his coffee and ponders a new sig...
Steganography anyone? :)
I odn't think any government who has reason to believe you to be hiding something would fail to check if it was in plain view or not.
Otherwise criminals would all be using those ghost markers kids use
Silly rabbit
The attack doesn't work.
Having worked in telecommunications as well as consumer electronics and computing, I've played a lot :)
One of the more interesting things for fun was to poke around with a induction amplifier, you know, the "hound" in the fox and hound tone generator/ handheld probe that the phone guys use for tracing copper thru a building.
It is pretty sensitive and I've found many fun sounds by waving it around in various analog and digital equipment, it kinda gives a unique viewpoint. Used in different locations in a PC it picks up various interesting sounds that are very different according to what the system is doing, and where you are probing, memory, chipset, io/chips, cpu etc. Never found it very good for troubleshooting PC's, but lots of fun!
Also, I think the sounds you can hear around running electronics is partly caused by sympathetic viberation induced in the air molecules by high frequency energy changes happening, especially on the buses where there are long runs exposed, as well as perhaps by the caps, (?), could it be the aluminum in the caps is reacting to the energy field?, most of the round tall caps you see on a board are used on low frequency mainly power filtering applications.
Even if the FBI/NSA can't manage to decode your data, the fact remains if they get to look at your HD via a warrent and they discover 20 GB of encrypted data rather than anything readable, they know you're hiding something from their view.
That discovery encrypted data can still be used as evidence in justifying further warrants... while discovering 20 GB of Britney Spears music in readable form would most likely cause the investigation to give up on worrying about the contents of that hard drive.
If you really want to strap on the tin foil hat, that warrant you mentioned 1) Doesn't need to be approved by a judge in done in the name of terrorism 2) They don't have to tell you about it. So if they were interested in the encrypted stuff on your hard drive, they would come in, do a bitwise copy and decypt and their leisure.
Somewhere, something incredible is waiting to be known. -- Carl Sagan
Please ignore the other AC. The parent bored me so much I fell asleep and have only now woken up, discovering that I've missed my train.
We must defeat these terrorists who induce the academics of this country into semi-permanent comas.
It's pure flamebait. That's his life. Sad really.
I recall reading rumors of a blind fella who could play MunchMan on the TI-99/4 just by listening to the sounds in the background of the game.
While my experience is no where near that in-depth, I do remember that the computer made distinct sounds when performing certain tasks, such as reading GROM, initializing, running BASIC programs (I recall that some statements also have distinct sounds as well.)
Since then I have been able to detect certain sounds from my machines which indicate normal operations; to some extent I think we all do, just as we do with cars to "know" that something isn't right. And it's been pretty consistent through all of my computers: Commodore 64, 128D, Atari 800XL, various Amigas (amazing things heard by holding your ear to the A500 power supply,) many desktop PCs and notebooks. Even some console systems generate sounds under operation (an old NES on my shelf with a bad filter cap is good for this.)
I'm curious to know what correlations between design type, grounding, processor architecture, and other factors exist for this. Might be worth investigating like this chap did, should I find the time to do so.
I was to be able to tell if a 8088/8086 CPU was under high CPU load just by listening to the high pitched sound it made.
From excellent karma to terible karma with a single +5 funny post...
This isn't news. Alias' Marshall has been doing it for years.
How can you differentiate between computations , when the CPU is at 100% utilization all the time? :)
Actually sound from computers can come from many places, and sometimes you han make out a hell of a lot of info about what a user is doing.
Typical CPU HLT execution either by the O/S (linux and w2k or so i thought... w2k didn't do it too good when I tried it) or by an external program (on ring 0) e.g CpuIDLE will cause several things, from what I've experienced:
Variable fan speed: Typical cheap comes-with-case power supplies regulate +5V whiwh surprise! gets a greater power draw when CPU is busy. Result, you fan sounds higher pitched when you ger a greater CPU load since +12V isn't regulated and the draw on +5V affects it. My newer power supply (old one died) doesn't seem to do this anymore, my old one, especillay with my old CoolerMaster fan (pretty noisy) was exceptionally good at this.
Transformer/inductance/capacitor hum: when I turn off the main CPU fan you can distinguish some hums from several places in my pc, exclusind the power supply fan. Causes can be anything from sound being played thorugh some soundcard transformer to CPU drawing more power though something.
Also, MANY other noises plague PCs:
HDD head movement. I'm sure someone has developed a way to measure approximately what area of an hdd a user is accesing by listening to head noise.
CDROM spinning/head moving/tracking/focussing. Wow do these 52x drives make a helluva lot of noise!
Modem. Surely a mike placed next to the modem transformer could pick up the signal, and it then could easily be decoded to get the stream of PPP packets.
speakers/soundcard. If I crack up the volume, depending on inputs selected, etc I can easily hear different noises, when I move a window, when I scroll something, etc they all make different noises/click rates. Of course it scares the hell out of me when someone IM's me through Jabber with that ding-dong noise.
Take that and keyboard/mouse/CRT monitor/whatever noise and you have a wealth of information which you can use to predict what a user was doing.
This is the researcher...
Eh.. What does it matter? I just completed a five-minute proof that P == NP! Have I had it reviewed yet? Well, no, but I guarantee it's correct! So now all I need to do is tell someone other than /.
What is your penile percentile?
Time to start designing tin foil hats... ...for your computer.
Man, that is real geek stuff.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The processor is operating at several gigahertz; in other words, the electrical signals are changing thousands of millions of cycles a second.
..... start by waving pound notes in their face, or threatening them with a knife. Anyone with a family is even more vulnerable.
A microphone will pick up frequencies from just shy of DC, to a few tens of kilohertz. Let's be really generous and suppose that the microphone can follow a vibration of 100kHz. A 2GHz signal will have changed 20 000 times in the same amount of time the microphone's diaphragm could have moved back and forth once. Need I say more?
It's like the myth about hard disk data being recoverable even after several overwrites. It isn't -- that's how magnetic storage devices work. And if it was, then somebody or other would have designed a drive that used the phenomenon to pack more bits in a given space.
But, there are plenty of reasons why somebody might find it useful to convince The General Public and others that they were leaking data. Selling products and services ostensibly to stop such leaks is one of them; persuading people to comply "because we can tell if you're misbehaving and we'll punish you twice as hard if you're lying about it" is another. It is all just classic misinformation.
There are easier ways of getting at someone's data anyway
Je fume. Tu fumes. Nous fûmes!
In Russia, there are _many_ companies that sell special equipment protecting your computers from being "listened" to. Look:
E 8% ED
http://www.yandex.ru/yandsearch?text=%EF%FD%EC%
Almost all links are related to this subject. Sometimes they sell bizarre hardware which is required by secret services, major businesses and militaries.
There is a reason they tried this on RSA, and not, say, encrypting a large file with some symmetric key algo: All operations in the RSA cryptosystem involve modular exponentiation, which means that for relatively large chunks of time (a few dozen microseconds, maybe), is either squaring a very large number, multiplying it by another very large number, or reducing the very large number to a not-so-large number. Each of these operations might last long enough to have a detectable acoustic signature, knowing the particular sequence of operations (square, multiply, etc.) would tell you the private key. But that would only work if the computer is decrypting, signing, or creating a new key.
(I'm a co-author of the presentation.)
The web page was extended to include a FAQ discussing the issues brought up here.
True, listening to the keyboard is valuable, if you either
- Have full physical access to the computer, and can key in identical pass phrases
or
- The text is typed into the computer as you listen.
Without access to an encrypted secret key or if the data has another source than the keyboard, you can't get the data by listening to the keyboard.
Each attack has it's own advantages and disadvantages.
Irene KHAAAAAAN!
Wow! Great.
So now we have *yet another way* to spy/be spied upon!
Van Ech Phreaking (original paper, SW source for Echbox, simplified description ) is bad enough, now we have to watch for shotgun mikes!
Hook this up with Wardriving and Let The Games Begin.
Although, apparently, this has a *LONG* way to go before a full password capture is feasible using the technique.
(By the way there is a wireless security presentation here that is quite good (had info on some stuff I hadn't heard about. For example Warchalking)
With the introduction of IP telephony, one of the first things people are going to want is encryption or people could just sniff packets and record your phone conversation. So telecomm equipment vendors like Avaya, Alcatel, Nortel, etc must allow for wire taps (as per the FCC).
--------
Free your mind.
Yes, my dad wrote a bunch of programs for the MicroAce* that worked this way. With no sound output, you just manipulated some bus signal or other, and put a radio antenna close to the back of the vacuum formed plastic case. I don't think anybody would ever bother emulating most of those programs. Besides he published lots of them in the zx81 hobbyist magazines.
*The MicroAce was a build it yourself clone of the Timex/Sinclair that was cheap. After all, the Timex/Sinclair was almost $100 at the time.
Even further offtopic: Only a year or two later, a friend of mine with an Apple wrote something he called Monkeywrite. This was very much like what is now Dissociated Press.
Assembly is the reverse of disassembly.
>brain pop
it's like Van Eck, only scarier.
makes me wonder though...
Seems to open the door for a true broadcastable computer virus.
I mean, if you can can get sound out, and it means something, why not put instruction-filled sound in, overriding currently queued instructions...
I've finally figured out how Cobra Commander is able to appear on ALL televisions at once before revealing his plans to take over the world!
I think this form of signal sampling is limited to packages which implement
_ ________
to the cryptographic primitives without any "salt".
The high industry standard for cryptographic implementations dictate that
randomizing operations (operations which results don't effect the final
result, but do disrupt both the process pipeline and the processor's energy
consumption - hence sound output) be carried out during all cryptographic
primitives.
This enables each run of a cryptographic primitive to be unique as far as
energy consumption and processes pumped through to the pipeline are
concerned.
It an interesting bit of research, but nothing new or extraordinary has
been developed.
Arash Partow
_________________________________________
http://www.partow.net
Arash Partow's Philosophy: Be a person who knows what they don't know, and not a person who doesn't know.
the graph showing no signal when the microphone is turned off is no surprise and proves nothing. The microphone being turned off closes (shorts) the circuit which would naturally soak any signal (no potential between neg and pos since they're shorted). If you killed the mic by opening the circuit, you would get environmental noise through your speakers, since as was mentioned the microphone and/or cable could act as an antenna in this condition. Additionally the "handkerchief" test case doesn't really prove anything either since as it was mentioned it's non-conductive and as such RF noise would go through it. what they need to eliminate relevant factors is not a audio noise filter but an RF noise filter such as an earth-grounded conductive mesh around the recording apparatus.
When I was about 6, my dad had a work laptop that he brought home. It had a grey-scale screen, dual 3.5" floppies, 4 (I think) MB of RAM, and no hard drive.
The only things he had for it was WordPerfect and "Where in the World is Carmen Sandiago?" Based on the sound of the spinning drive, I could decipher which of the multiple choice answers was correct to move to the next stage while the current stage was loading. After a while, I started plugging my ears while a stage was loading so the game didn't suck.
"There are no such things as mutual fantasies. Yours bore us and ours offend you."
- Bill Maher
The audio circuitry on my ASUS motherboard is such that I can hear the CPU activity through the speakers at the normal volume settings. And based on the sound, I can tell how much the cpu
is idle. Apparently, it is when linux puts the CPU in a halt state that it makes the noise because if I do something CPU intensive (such as gzipping the kernel) it is actually quieter.
In the old days, I used to listen to the RS-232 signals going to the terminal since they shared an output line on the CPU with the audio signals. I couldn't tell exactly what was being printed but I could definitely recognize patterns.
Later, I discovered that I could hear when the pattern changed on an ordinary CRT monitor displaying text. It was possible to tell, with my back to the computer, when, for example, a compilation completed and whether or not it was successful.
So, there are other possible low bandwidth audio leaks besides the one mentioned.
... the fact remains if they get to look at your HD via a warrent and they discover 20 GB of encrypted data...
/dev/random. Then when you start creating a filesystem you change around the bits on the disk, but it still looks like random data.
One of the nice features of crypto on Linux is that you preseed the partition with random data dd-ed from
I wonder if there's a way to see whether or not the disk has has a crypto filesystem on it, or if it was just being prepared for that purpose?
Good lock experts can break into a safe by using a stethoscope to listen to the tumblers in the lock. This is because they have a precise understanding of how the lock works, and a tool accurate enough to distinguish the differences (mainly the stethoscope and their ear). An absurd extension of this might be, if we had a precise understanding of the human brain, and instruments accurate enough to measure the differences in a paramter (like sound, heat, or electric current), one could put a stethoscope up to someone's head and know what they are thinking. Or use an infared signature, or EEG, etc. Equally absurd is knowing what a computer is "thinking" by listening to the noise of the CPU. But, with a precise understanding of the how the CPU works, and tools accurate enough to measure the signatures, it is theoretically possible.
I remember reading about encryption standards, and how AES (I think it was AES) created random noise in the cpu to protect against this kind of attack. I cant find any sources backing me up, as I cant even remember where I had read this information. If anyone has information on this, I am sure others are interested also.
This attack can be easily twarted by just running multitasking operating system, a short time slice and other tasks.
Didn't Kocher mention something like this in relation to his now legendary "Timing attacks" paper?
This is soon to become the exception. Mac OS X already has the ability to encrypt your ENTIRE home directory. Longhorn will have plenty of encryption as well. And paranoid people are increasing encrypting everything they can get their hands on.
Who moved my sig?
1. Apply microphone to side of PC's case 2. Allow "Tin Foil" program to analyze the frequencies coming from your computer while it performs multiple encryption/decryption sessions. 3. Tin Foil program will then emit random combinations of those frequencies matching the CPU's frequencies through the PC's speakers, thus making any audial system compromise impossible.
Who moved my sig?
Strange thing is that high cpu usage actually dampens the noise, so my solution was to run a distributed computing client (THINK, in my case, but others will do as well) to keep the cpu busy. Works perfectly, and I even forgot I had the problem until I read this post.
I do think it's pretty lame that so many on-board audio chips have this problem.
This oughtta give'em something to listen to: http://www.erikyyy.de/tempest/
The U.S. really needs an English to Wisdom dictionary.
what I don't understand is how this would be practical in a multitasking environment. It's not that the CPU doesn't do anything else.
So I have a lot of unrelated activities going on on my notebook -- say I am running iTunes in the background decoding mp3 files -- how are they going to tell the difference of the noise made by the CPU when encrypting/decrypting and decoding mp3 files?
afaik, acoustic noise in dc-dc converters (as on a pc motherboard) emanates from the inductors, NOT from the capacitors ! The effect is known as "magnetostriction". Caps and coils should be placed in close proximity on the pcb, so by applying the freeze spray to the capacitors they most likely are are also freezing the inductors. Or at least changing the capacitance and hence the ripple current.