Slashdot Mirror
Keys Leaking Through the Air At RSA
NumberField writes "The RSA Conference is underway in San Francisco. A theme among the opening speakers is that the attackers are winning, and even well-funded organizations like NASDAQ can't secure their networks reliably. The show floor is lively, but dominated by the typical firewalls and 'compliance solutions.' One interesting exception is a scary side-channel analysis demo in the Cryptography Research booth using GNU Radio to capture secret keys from various smartphones from about 10 feet away. (The method is related to early computer music using AM radio interference.)"
None of the links seem to be to anything very specific about the title issue ("keys leaking through the air")... was something mispasted in the submission?
I fucking hate summaries with a half dozen links that don't seem to link to an article actually discussing the issue in the summary.
Why approved this shit?
Wondering how Arron Barr's presentation on Social Network went... Though I might post as "Anonymous Coward", but don't feel like having my door kicked in by the Fed's today.
I'm not fat, just big boned...
"...organizations like NASDAQ can't secure their networks reliably " According to Netcraft, they use Windows server 2003 ( http://toolbar.netcraft.com/site_report?url=http://www.nasdaq.com )... Does this mean something? Just asking..
. are sensitive networks like NASDAQ even connected to the internet? There is a common fix for this issue called an AIR GAP. You simply physically disconnect the nternet from the sensitive technology, and then you work forward from there while always regarding the fundamental necessity of the air gap. It is, reckless and foolish considering the reality of the internet, to think you can connect and protect.
wtf is this article - is there actual content anywhere or is it an ad for the RSA conference?
I'm sorry that there's no direct article for this submission, and I'm not certain who submitted it, but as an employee of CRI and one of the designers of the demo, I'd like to give you some details about what's going on.
At CRI we have a lab full of what I consider to be cool equipment, and what's more, some spare time to look at things. We specialize in side-channel analysis and we asked ourselves: what sort of side-channel leaks might be present in consumer PDAs? We took a USRP(1) interface that we had lying around and started investigating the RF emanations of a few of the devices we had easily on hand. We coded some simple cryptographic applications and were surprised at how quickly we were able to find ways to demodulate the various signals in the device in a way that revealed the bits of the secret keys being used.
We are indeed using GNURadio for the demo. It's been very helpful because it makes rapid prototyping very easy. We use gnuradio-companion to set up the signal processing blocks (mostly AM demodulation) and to set up a simple UI that helps us tune into the right carrier frequencies in real-time during the demo. The rest of the demo involves using our own custom waveform viewer to look at the demodulated signal and show visitors how we can analyze the signal on the screen and extract the key bits that were used during the encryption/decryption process on the device.
Get your fat ass to bed and then go talk to Marie O !!
Gee what a surprise, someone at RSA is demonstrating that RSA users' wireless is insecure. Next story please, this is done and tired.
The side-channel analysis was the most fascinating blurb in this article. Thanks for sharing how this works. Are all PDAs so RF noisy in their processing? Have you considered using this technique on some modern smart phones?
Couldn't you design the assemblies so the boards could be conformal coated with a dialectic layer and them potted with a RF absorbing layer and then a grounded layer as not be able to pick up the emissions in the first place.
years ago i predicted that such attacks could be utilized to crack TPM keys and such, looks like my prediction was tending towards correct.
Snowden and Manning are heroes.
Gee, this takes me back. The IBM 1130 (actually IIRC a later clone) had a 'Winchester' (IBM model 3030) washingmachine-sized drive with a 5 HP stepping motor to drive the arm, and removable 5 MB disk packs. Somebody back in the mists of history figured out that if you put a transistor radio on top of the console in the right place, the disk controller signals that drove the stepping motor made enough EMI to generate an AM radio signal. So they wrote an assembler program that could play different songs according to data stored on a data cards that followed the program cards in the deck. So we could play "Jingle Bells" while thrashing the disk seek mechanism. Big Fun!!
Those Winchester drives would actually walk across the floor if the seek cycles got in sync with the natural resonant frequency of the box itself. Five horsepower (about 4 KW) has to go somewhere.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/