Slashdot Mirror
RSA Keys Can Be Harvested With Microphones (theregister.co.uk)
Researchers have now demonstrated that even with modern laptop, desktop, and server computers, an inexpensive attack can harvest 4,096-bit encryption keys using a parabolic microphone within 33 feet -- or even from 12 inches away, using a cellphone microphone.
An anonymous reader quotes this article from The Register:
In both cases it took an hour of listening to get the 4,096-bit RSA key... As a computer's processor churns through the encryption calculations, the machine emits a high-frequency "coil whine" from the changing electrical current flowing through its components... The team recommends encryption software writers build in "blinding" routines that insert dummy calculations into cryptographic operations. After discussions with the team, GNU Privacy Guard now does this.
Even if they have my RSA keys, they don't have my RSA locks!
Then you won't likely get coil whine as much.
Must be harder to acquire on laptops since they can also use battery as a power source :)
How is this not a reiteration of this old attack from 2014: http://www.tau.ac.il/~tromer/h...
Just kidding... Pretty scary fact
Play an MP3 at the same time so they get a audio download then send them a DCMA takedown notice :)
Since computers can play music, if worried about this, play music when using the computer. If the speakers are near the cpu (on a laptop most are), they would mean that one has to remove the music track before finding the signal. Try music that is more random making the process harder.
I wonder how vulnerable smart cards are. In particular, I've been using an YubiKey for most of my RSA needs.
How about eliminating coil while with some magical, new power components instead? It would be nice to get that C1e induced painful buzz in check. Is there a power supply brand which doesn't whine with C1e active?
Can someone explain, vaguely, possibly with a car analogy, how they go about determining keys with coil whine? Is it because the same calculations are made over and over as it churns through data encrypting/decrypting it, so after listening long enough some kind of clues can be gathered about what bytes are in the key? I mean, I assume it's not as a simple as listening and going "Ooh, 14.5Khz, that's 0xBE."
systemd is Roko's Basilisk.
These "attacks" are always on carefully selected hardware running custom software. There is no way on a real system this would work.
Rubber hoses, too.
Could we please stop news from this site. Every time I read a story from these "journalists" and their "tech" jargon I feel like somebody just took a dump on the English language. Half of the time I don't understand what they're saying and half of the time I feel like someone's telling inside jokes. They want to be smarty-pants with their high-tech lingo but they only come across as people that invented words for the terms they don't understand.
Whilst I am prepared to accept the findings of this research and happy to accept that in principle it is possible to infer the calculations being performed by a computer system using nothing more than the "background noise", they produce, I have to believe that there are a myriad of easier ways that the same information could be obtained:-
https://xkcd.com/538/
It is likely that these attacks may be attempted by government agencies looking to crack encryption operated by foreign powers. However, in the majority of the cases I've personally looked at, I see poorly-implemented surrounding controls. Issues include having passphrase data stored on a computer so that an application can decrypt traffic without human intervention, only to have that passphrase file left protected by nothing more than local file system permissions. Let's be honest, owning the file with root and setting permissions to rw-/---/--- aren't going to pose much of a problem to a determined attacker, are they?
This is one of the fundamental issues with encryption: people believe that because they are using high strength key lengths that they are secure; no thought is given to local protection of critical data, to PRNG entropy, to side channel data.
Too many people get blinded by, "Oh, it's OK, it's encrypted", when that means squat if the related safeguards are compromised...
This possibly can't be real or, these guys are geniuses. Certainly the coil whine will change depending on the load of the machine. However, there's so much stuff happening in a CPU and the system bus that I find it extremely hard to believe that you could listen to any specific numbers. There's also all sorts of power filtering going on and there's decoupling capacitors on the chips.
However, if this is real, then I assume that listening to network traffic would be doable as well.
Reminds me of a differential power analysis attack but that requires physical access to the machine. With this microphone attack you just need to know which type of machine it is and proceed in a completely covert manner.
It always amazes me how inventive a determined attacker can be. On a defense project back in the 90's we had to keep our analog phones six feet away from CRTs to prevent monitor EMI from entering the phone line. That EMI could be analyzed by a third party to recreate the monitor's image.
Dan J. Bernstein has talked about the need for crypto to use constant time and no data-dependent branch assembly implementations to avoid this and other attacks for years.
Don't understand why this hasn't been done yet with current gen consoles. Seems like getting the encryption keys this way would save a lot of time.
How the hell do they isolate the key from all that is going on around it?
In order to obtain the laboratory effect of single threaded decryption of 4,096 approximately 1Mbit files in sequence you would have to be root and generally have all "messy" asynchronous processing such as interrupts from the network card disabled. This is a lab-only non-realistic attack. If you had that much control over the CPU you might as well just read the key out of the registers as it is used.
This is well-known "modular exponent side-channel attack". /different/ than multiplucation (twice faster in fact) and this algo difference has impact on cpu power consumption.
Its idea is like this: we do exponentation one bit of exponent at time. If we meet 1, we do square and multiply. If we meet 0, we do just sqare.
The catch is, sqare is
As result, it's possible to extract some useful info about secret things like private keys just by watching how much power cpu consumes.
This thing is most relevant for smartcards, which keep private keys inextractable and have limited memory computational power, so square vs multiply optimization is required.
But it hardly relevant for PCs, where all secrets live on its drives. You get PC you get secrets. PC also has multiple cores and plenty of memory. This allows to use more sophisticated arithmetic optimizations which render this sqare vs multiply difference nearly harmless.
IMHO journalists try to make FUD out of nothing.
https://youtu.be/DU-HruI7Q30
In GOD we trust, all others we monitor.
How do they come up with this stuff? Seriously?
I think you would have to be an idiot with absolutely no understanding of how computers work to believe this is (practically) possible.
pretty sure I heard something about this 20 years ago, on a movie.
Of course it was total bullshit then. It's still total bullshit now.
Like the old rumor you could listen to a dial-up modem connecting and learn someones password. Of course, it's total crap.
and not funny either.
Now I can't access the drive at ALL!! I'm really hoping it comes back I have a lot of photos and music that aren't backed up. Also, the knocking is still there.
d-_-b
I doubt the cellular phone even needs to be hacked. Half the people around you probably already have an app around that's already listening (but don't worry, they say they're not).
I still can't get Shazam to recognize this *&^@#*&^ song!