4 ms·

Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitor

Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/

segfaultbuserr 6y ago
> Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/
- anfractuosity 6y ago
  Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
  - segfaultbuserr 6y ago
    > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/

segfaultbuserr 6y ago

> Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/

anfractuosity 6y ago
Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
- segfaultbuserr 6y ago
  > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/