4 ms·

Why is "temperature sensor trigger" listed under the 'security' bullet? If that's not a mistake, could someone please explain how that's a security feature?

jeroenhd 6y ago
I can't be 100% sure, but temperature fluctuations can often be used to execute side channel attacks on processors and chips on board. If the system analyses the temperature sensor for that, it might prevent leaking key material. I don't think I've seen anyone do that in practice though, it might just have been that they had to put _something_ extra in the security features and just added whatever sensor wasn't listed yet.
- kingosticks 6y ago
  That would be my guess but that sounds really difficult to get right and you'd imagine all finds of false positives from it. The kind of feature you put in but leave disabled by default.
extropy 6y ago
Defense against cold boot attacks? https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
numpad0 6y ago
Probably a part of tamper detection. Not said anywhere but the spec looks like this is a good fit for military or industrial control panels.
segfaultbuserr 6y ago
In embedded devices, the on-die temperature sensor can theoretically be used as a countermeasure to (the equally theoretical) high temperature fault injection attacks - the attackers heat up the chip until it starts flipping bits, then some security checks can be bypassed (e.g. see [0]). It's often proposed by the literature that the firmware should read the on-die temperature sensor constantly, and when it's outside the nominal operating range, halt execution, and possibly erase secret. However, while it's often proposed as such, I don't think it's actually useful - thermal fault injection is a real threat, but I said "theoretical" since it's the least of your problems when the attacker has physical access - both clock and power fault injection are easier. Nevertheless, at least a countermeasure to thermal faults is reasonable if you are just protecting a smartcard where everything is on a single chip. On the other hand, for a computer motherboard, such a sensor looks pretty useless. The target is simply too large to be protected (unless you can seal the entire system in a box fitted with sensors like a hardware security module). But I guess it is still a theoretical security feature, thus it was listed as such despite its uselessness. [0] https://eprint.iacr.org/2014/190.pdf https://eprint.iacr.org/2014/190.pdf > [...] We further presentheating faults by operating the devices beyond their specified temperature ratings. The efficiency of this kind of attack is shown by a practical attack on an RSA implementation. Finally, we introduce data remanence attacks on AVR microcontrollers that exploit the Negative Bias Temperature Instability (NBTI) property of internal SRAM cells. We show howto recover parts of the internal memory and present first results on an ATmega162. The work encourages the awareness of temperature-based attacks that are known for years now but not well described in literature. It also serves as a starting point for further research investigations.
- fulafel 6y ago
  Also, other tamper resistance mechanisms (such as the mentioned tamper sensors) could be disabled by excess heat.

jeroenhd 6y ago

I can't be 100% sure, but temperature fluctuations can often be used to execute side channel attacks on processors and chips on board. If the system analyses the temperature sensor for that, it might prevent leaking key material. I don't think I've seen anyone do that in practice though, it might just have been that they had to put _something_ extra in the security features and just added whatever sensor wasn't listed yet.

kingosticks 6y ago
That would be my guess but that sounds really difficult to get right and you'd imagine all finds of false positives from it. The kind of feature you put in but leave disabled by default.

extropy 6y ago

Defense against cold boot attacks? https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack

numpad0 6y ago

Probably a part of tamper detection. Not said anywhere but the spec looks like this is a good fit for military or industrial control panels.

segfaultbuserr 6y ago

In embedded devices, the on-die temperature sensor can theoretically be used as a countermeasure to (the equally theoretical) high temperature fault injection attacks - the attackers heat up the chip until it starts flipping bits, then some security checks can be bypassed (e.g. see [0]). It's often proposed by the literature that the firmware should read the on-die temperature sensor constantly, and when it's outside the nominal operating range, halt execution, and possibly erase secret. However, while it's often proposed as such, I don't think it's actually useful - thermal fault injection is a real threat, but I said "theoretical" since it's the least of your problems when the attacker has physical access - both clock and power fault injection are easier. Nevertheless, at least a countermeasure to thermal faults is reasonable if you are just protecting a smartcard where everything is on a single chip. On the other hand, for a computer motherboard, such a sensor looks pretty useless. The target is simply too large to be protected (unless you can seal the entire system in a box fitted with sensors like a hardware security module). But I guess it is still a theoretical security feature, thus it was listed as such despite its uselessness. [0] https://eprint.iacr.org/2014/190.pdf https://eprint.iacr.org/2014/190.pdf > [...] We further presentheating faults by operating the devices beyond their specified temperature ratings. The efficiency of this kind of attack is shown by a practical attack on an RSA implementation. Finally, we introduce data remanence attacks on AVR microcontrollers that exploit the Negative Bias Temperature Instability (NBTI) property of internal SRAM cells. We show howto recover parts of the internal memory and present first results on an ATmega162. The work encourages the awareness of temperature-based attacks that are known for years now but not well described in literature. It also serves as a starting point for further research investigations.

fulafel 6y ago
Also, other tamper resistance mechanisms (such as the mentioned tamper sensors) could be disabled by excess heat.