New side-channel attack leverages coil whine

Jun 4, 2016 21:44 GMT  ·  By

Sound emanating from different components exchanging data inside a computer can leak cryptographic keys, a team of five researchers from the University of Tel Aviv has discovered.

The researchers exploited coil noise, also known as coil whine, a term used to describe the sound made by coils and other components as electrical current passes through them.

The team of five says they can measure this sound and extract binary operations from the soundwaves. Knowing the exact pattern of bits, they can reverse-engineer computer operations.

New side channel attack can compromise RSA-4096 encrypted comms

If the computer was engaged in cryptographic data exchanges, the researchers claim they identified multiple side channel attacks for extracting the encryption key needed to start decrypting the exchanged content.

  By recording such noise while a target is using the RSA algorithm to decrypt ciphertexts (sent to it by the attacker), the RSA secret key can be extracted within one hour for a high-grade 4,096-bit RSA key. [...] A surprising result of our research is how practical and easy are physical key-extraction side-channel attacks on PC-class devices, despite the devices' apparent complexity and high speed.  

Researchers say that the attack relies on inexpensive equipment, usually cheap microphones, along with sound recording and analysis software.

Attack works with cheap microphones and even with pita bread

Their attack works against any computer as far as 10 meters away using a parabolic microphone. If carrying around a huge glass-encased microphone like the one from the photo below might give away your villainous intentions, the researchers said there are less conspicuous ways to perform the attack.

Attack rig relying on powerful microphones
Attack rig relying on powerful microphones

A malicious party could also use a smartphone's microphone and a consumer-grade radio receiver. This attack works as far as 30 cm away from the target, so placing your phone next to someone's computer at work or at a cafe would be enough. The downside is that this portable attack takes more time, usually around or more than an hour.

Additionally, if you really want to stand out from your spy friends, the researchers also created an electronic device embedded in a pita bread that can also extract cryptographic keys, but by means of electromagnetic waves.

In fact, four of the five scientists who contributed to this research had previously published another study in February of this year. What they did then was to extract encryption keys from electromagnetic waves emitted by a computer placed in another room, through a wall.

Mitigations exist. Some work better than others

The researchers also presented a series of countermeasures. Hardware-based solutions would have users deploy Faraday cages or sound-absorbing equipment around their laptops. Even the researchers admitted that these are very impractical in the real world.

Software-based solutions are easier to implement. The researchers say that blinding attackers by inserting random data in encrypted communications is a more fitting solution to mitigate these attacks. Based on their recommendations, the GnuPG project has already added ciphertext randomization to their software.

The full research paper, titled Physical Key Extraction Attacks on PCs, is available on the website of the Association for Computing Machinery.

Attack rig relying on a custom rig embedded in a pita bread
Attack rig relying on a custom rig embedded in a pita bread

Photo Gallery (4 Images)

New attack can extract encryption keys from coil whine sounds
Attack rig relying on powerful microphonesAttack rig relying on a smartphone and a small radio
+1more