What do potato chips and lost car keys have in common? On the surface, it would seem not much, unless you somehow managed to lose your keys in a bag of chips, which would be embarrassing enough that you’d likely never speak of it. But there is a surprising link between the two, and Samy Kamkar makes the association in his newly published 2019 Superconference talk, which he called “FPGA Glitching and Side-Channel Attacks.”

Information on the Side

Most of Samy’s talk is devoted to explaining the nature of side-channel attacks, which he defines as “information you’re gathering from an implementation rather than the algorithm or system itself.” I found that to be a particularly instructive way to think about side-channel attacks, since they provide what is often a completely unforeseen way into a system despite there being no direct vulnerabilities of the kind usually associated with exploits, such as software bugs or weaknesses in cryptographic systems.

The world of side-channel attacks that Samy describes is a weird place where attacks can come literally out of the blue. They can squeeze information from the slightest of signals, like snooping into what a user is typing by monitoring the unique mechanical vibrations of each key, either with a microphone or by bouncing a laser off the machine to pick up induced vibrations. Ultrasonic attacks based on electrostrictive vibrations of capacitors that betray the internal state of the target machine are possible, as are attacks based on the slight changes in power usage as a target goes through its paces. And some of these side-channel attacks can even target air-gapped machines, which is nightmare fuel for security pros.

And it’s not even just computers that can be compromised with a side-channel attack. Samy related a story of security researchers who managed to exfiltrate a normal conversation from a sealed, soundproof room simply by pointing a DSLR camera through a window at a potato chip bag on the table. The bag vibrated slightly with the air pressure changes caused by the voices in the room, enough to create a signal in the video captured by the camera. Side-channel attacks seem to be limited only by the imagination of the attacker.

Injection Detection

Samy also spent a lot of time talking about fault injection attacks. We’ve featured a few of these recently, including attacks on smart speakers using lasers to induce a signal on the MEMS microphone, making Alexa do your bidding remotely. Samy relates that and similar attacks on drone IMUs with ultrasound, which we found fascinating. Yet wilder are temperature attacks, where memory chips are flash-frozen with a blast of propellant from a gas duster; by cooling down the capacitors in a memory chip, it can extend the discharge time long enough to remove the chip and dump its contents using another device, potentially exposing passwords or other sensitive information.

Perhaps the most interesting technique Samy explained was instruction skipping. Clock glitches are slightly malformed pulses in the normal stream of clock pulses in any …read more

Source:: Hackaday