10 ms·
Recovering secret keys from devices using video footage of their power LED
- ngneer 3y agoThis reminds me of optical TEMPEST work from early 2000s, but for network gear http://www.applied-math.org/optical_tempest.pdf http://www.applied-math.org/optical_tempest.pdf
- jcpham2 3y agoWow that’s an extremely interesting side channel
- greyface- 3y ago> Q: Why do attackers need to obtain video footage filled with the LED of the target device? > A: Cryptanalysis requires a high sampling rate. > By filling the frame with the LED, attackers exploit the rolling shutter to increase the number of measurements of the color/intensity of the LED by three orders of magnitude from the FPS rate (60 measurements per second) to the rolling shutter's speed (60K measurements per second in iPhone 13 Pro Max). A sampling rate of 60k can provide the needed sampling rate to attack functional IoT devices (smartphones, smartcards, TV streamers, etc.). Using a single frame captured with rolling shutter as a 1-bit high-framerate video. Very cool technique!
- detrites 3y agoThis is very cool, but I can't understand how 60khz is enough resolution to usefully discern what would be happening inside a CPU, etc, that's running way faster than that? (Disclaimer: I can't read the article as it says "browser not supported".) EDIT - Answered here: https://news.ycombinator.com/item?id=36332352 https://news.ycombinator.com/item?id=36332352
- dfox 3y agoThe idea is that in typical assymetric cryptosystem you do some variant of bitwise exponentation of “large values” (ie. slow) and both the power envelope and timing is directly related to individual bit values of the private key. This trivially works for RSA and also anything involving integer-like groups and then even for “classic” ECC, things like 25519 are intentionally designed to mitigate this kind of side channel.
- gugagore 3y agohttp://people.csail.mit.edu/mrub/VisualMic/ http://people.csail.mit.edu/mrub/VisualMic/ uses the rolling shutter to get audio from regular-framerate video of a bag of chips.
- tecleandor 3y agoIn that paper they use a "regular" high framerate camera. Those cameras are usually low resolution. I guess what could be more interesting or practical: Low-res very high FPS, or very high resolution, and regular/high FPS (having more pixels would give you more sampling opportunities...).
- gugagore 3y agoThey use both.
- dmurray 3y agoIn five years our budget-level Android phones will have both!
- tecleandor 3y agoI'm not super convinced about that. The (raw) quality in the phones sensors hasn't climbed as quickly as on dedicated cameras this last years. The secret sauce for today's phone's cameras is a lot of processin, and if you get an unprocessed photo from a current day phone-size sensor is almost as bad as one from yeeears ago. And that's OK for regular photos, but I guess is not that good if you want to do image or signal processing and your data has already gone through some other processing and a "IA".
- Kirby64 3y agoRaw sensor size in cell phones has massively increased compared to years ago, and improvements in sensor technology (BSI, for instance) has improved performance of sensors of similar size. These did not exist before. Obviously processing is getting more powerful, but I think you're discounting the improvements in the space. There's a few notable exceptions (e.g., Pixel phones used the same kinda crappy sensor for many generations), but largely people keep using the newer, better sensor on flagship devices.
- hyperthesis 3y agoenhance!
- jesse__ 3y agoThis is the most ridiculous and awesome thing I've read in quite some time.
- lunatuna 3y agoIt's dated now, but 'Silence on the Wire' was a fun read. Chapter 5 is even available for download: https://nostarch.com/silence.htm https://nostarch.com/silence.htm
- TechBro8615 3y agoThere have been a number of these side channel attacks, and they're all equally cyberpunk and hard to believe, e.g. this one [0] from 2014: > We describe a new acoustic cryptanalysis attack which can extract full 4096-bit RSA keys from the popular GnuPG software, within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate such attacks, using a plain mobile phone placed next to the computer, or a more sensitive microphone placed 10 meters away [0] https://www.iacr.org/archive/crypto2014/86160149/86160149.pdf https://www.iacr.org/archive/crypto2014/86160149/86160149.pd...
- coppsilgold 3y agoWith acoustic access, attacking the human directly is more advantageous. You can log the sound of every key press and differentiate between them. Then solve the resultant primitive substitution cipher - each key will have a distinct sound signature, solve the mapping. Don't need physical access to the keyboard at any point. Example: <https://github.com/shoyo/acoustic-keylogger https://github.com/shoyo/acoustic-keylogger>
- stOneskull 3y agoit's amazing and dazzling.
- valleyer 3y agoHere is why they claim this is possible. Basically, it's a form of timing attack. > As observed in the papers presenting the Minerva [8] and TPM-FAIL [9] attacks, many common cryptographic libraries optimize the computation time of ECDSA signing by truncating any leading zeros. This optimization results in a variable number of loop iterations that is associated with a variable execution time for the entire main loop, which is determined by the number of leading zeros in the randomly generated nonce. > Thus, by measuring the signing time, attackers can detect the number of loop iterations and determine the number of leading zeros in the nonce k, which can be used to extract the target’s private key using lattice techniques, in which the signatures whose nonces have many leading zeros are used to construct a hidden number problem, which is reduced to a shortest vector problem and solved using lattice reduction (see [8] for details).
- rkagerer 3y agovariable execution time --> a bane of security. Why aren't cryptographic security algorithms that defend against sidechannel timing attacks by guaranteeing fixed execution time more common?
- NavinF 3y agoDJB cipher suites do that, but a lotta people have no idea how to select cryptographic primitives so they go for something that was popular 30 years ago. Some fun slides with examples of timing attacks: https://cr.yp.to/talks/2014.10.18/slides-djb-20141018-a4.pdf https://cr.yp.to/talks/2014.10.18/slides-djb-20141018-a4.pdf. Old standards like RFC 5246 often say shit like "it is not believed to be large enough to be exploitable, due to the large block size of existing MACs and the small size of the timing signal" and then get exploited 5 years later.
- ayende 3y agoAm I missing something? I thought the nonce had to just be non repeating, didn't have to be a secret.
- dfox 3y ago
- gnabgib 3y agoSome discussion yesterday: [0](120pts, 1 day ago, 25 comments). Seems like the dupe detector isn't happy.. [1](4pts, 1 day ago, 1 comment), [2](4pts, 14 hours ago, 1 comment) [0]: https://news.ycombinator.com/item?id=36310594 https://news.ycombinator.com/item?id=36310594 [1]: https://news.ycombinator.com/item?id=36315148 https://news.ycombinator.com/item?id=36315148 [2]: https://news.ycombinator.com/item?id=36322522 https://news.ycombinator.com/item?id=36322522
- willis936 3y agoMy first question was answered by the first answer in the FAQ: > This is caused by the fact that the power LED is connected directly to the power line of the electrical circuit which lacks effective means (e.g., filters, voltage stabilizers) of decoupling the correlation with the power consumption. The solution is simple: don't have crap power trees.
- fragmede 3y agoBut as the device is in the attacker's hands, even a good power supply could be compromised by replacing or removing capacitors that are used to smooth out the power rails. You'd have to open the device up to do it, but eg to get at the keys inside the secure enclave on an iphone, a couple devices could be sacrificed for the cause.
- LordDragonfang 3y agoI mean, at that point just read the key directly from the ram. The TLDR does emphasize this is for non-compromised devices
- sigstoat 3y ago> But as the device is in the attacker's hands, even a good power supply could be compromised by replacing or removing capacitors that are used to smooth out the power rails. slightly improving the argument, while keeping the device non-compromised, is that whatever info is coming out of the LED is probably coming out in RF, also. so getting the LED further away from the CPU's power rail(s) probably isn't going to help. they're already emitting the data. if you can stick a camera this close to the LED, you can probably surround the device with antennae, as well.
- marcosdumay 3y agoAlso, don't put high-power leds on everything.
- Turing_Machine 3y agoGood advice in general. I hate turning off the lights to go to bed and seeing LEDs glaring everywhere. I've banished most such devices from my bedroom for that reason.
- local_crmdgeon 3y agoGod damn that's impressive.
- daneel_w 3y agoA suitable Anti-Spying(r) decoupling capacitor costs 5 cents.
- Tuna-Fish 3y ago... which guarantees they won't be used by the vast majority of the devices that could benefit from them. There are a lot of manufacturers for whom 5 cents is about 5 cents too much if 0 cents is an option.
- NoPicklez 3y agoSuch a good way to put it haha
- miohtama 3y agoThese are likely to be present also because of non-cryptographic reasons
- eclipticplane 3y agoAnother point in the endless war against useless always-on LEDs. (My least favorite was a night light with a switch. It had an always-on LED when plugged in even if you switched the night light off. Instant e-waste.)
- red-iron-pine 3y ago> It had an always-on LED when plugged in even if you switched the night light off. Instant e-waste.) the point is so that you can find the light in the dark. it may be poorly made or unecessary but I can at least in theory understand the logic.
- danudey 3y agoWorking from home with my desk in my bedroom, I grew to hate the always-on, bright blue LED on my USB-C laptop dock. I get it, you're plugged in, go away and take your light pollution with you.
- 13of40 3y agoThe case I bought from Frys for my last desktop build a few years ago has a power LED that lights up half the room. I taped a penny over it.
- toast0 3y agoFor desktops, a nice solution is to hook up the power led to the speaker connection. At some point, pc speakers stopped coming with cases as they did in the past. And power leds have been mostly useless for a long time.
- amoshi 3y agoMultiple electronics' LEDs in my room have insulating tape on them, mutes the light brightness a lot!
- social_quotient 3y agoIf you are looking to block these out, I can’t recommend these stickers enough - LED Light Blocking Stickers, Light Dimming LED Filters https://a.co/d/aeSFTMI https://a.co/d/aeSFTMI They also have white versions
- yarone 3y agoI learned about this exact exploit in my computer security class at University circa 1999 or 2000: "power LED is connected directly to the power line of the electrical circuit"
- yarone 3y agoWe learned about affixing a camera to the data input / output LED's on a network interface card and by doing that capturing the ENTIRE data stream.
- rmbyrro 3y agoSo, now apart from covering camera lenses, I'll need to cover all my power LEDs as well. Nice.
- dylan604 3y agoI guess there's no need now to introduce backdoors for the FBI
- Eduard 3y ago> Q: What is the best way to prevent the two demonstrated attacks? > A: Use the most updated cryptographic libraries available. Or what about covering the LED(s) with something so that the camera filming the top secret computer non-stop doesn't have a chance to exploit the side channel? (excuse the sarcasm; but they were such low-hanging fruits I couldn't resist. The awareness is indeed important, as there are countless other side channels such as USB-cabled mice and keyboards with LEDs... Also: I'm writing this from a hotel room with a TV illuminating the darkness with its bright standby blue melatonin killer LED - about to hang a towel over it)
- bee_rider 3y agoI put a little dab of red wax on most of my LEDs, not enough to block completely, but just enough to turn it sunset color.
- disillusioned 3y agoThere are a number of LED tape options on Amazon, etc., that offer both extreme dimming and full blackout and they are game-changers for mitigating or removing the scourge of insanely bright blue LEDs in a dark bedroom.
- pmoriarty 3y agoI've used several layers of ordinary blue painter's tape with success for this purpose.
- djmips 3y agofrom Babybels.
- bee_rider 3y agoExactly!
- ComputerGuru 3y ago
- perdomon 3y agoShould I be worried about this? How easy is it for someone to put a high-resolution video camera close enough to the power LED on my computer for this to be a problem?
- nine_k 3y agoResolution is not needed, even high FPS is not really needed if the camera has a rolling shutter. An iPhone might be enough. But the recording needs to be done when your machine is decoding something using your private key, and doing nothing else. Ironically, you can always keep open a few pages infested with multiple video ads or other doodads that switch unpredictably, sap power, and thus add noise to your power consumption. Or run a CPU miner for some coin. Unironically, you can just put a bit of adhesive tape over your power LED if you're really concerned that someone cares enough to stage an attack like that against you.
- somedude895 3y ago> pages infested with multiple video ads I guess online ads do have a benefit for the user
- jschveibinz 3y agoAdd a low pass filter, i.e. a capacitor of correct value, to decouple the power noise from the LED. Here’s another technique to pick up information remotely with a video camera: a laser microphone. https://en.wikipedia.org/wiki/Laser_microphone https://en.wikipedia.org/wiki/Laser_microphone
- adrianpike 3y agoI built a fun hack back in college that used a laser microphone to listen to keypresses - the timing and sound of which is relatively straightforward to extract letter pairing heuristics from, and from that, given some time, you can build pretty strong guesses on people's passwords. The next step I was going to take it was to use to microphones on different windowpanes and be able to triangulate multiple keyboards in a room - never quite got there because my DSP skills were garbage, but it's in the back of the mind someday to pick back up if I ever take a sabbatical.
- ihaveajob 3y agoThis idea is straight out of Cryptonomicon. I remember being fascinated by my first modem's LEDs, and being mindblown when I realized that what seemed like different levels of green were actually the shape of a pseudo-random binary step function.
- corajoe 3y ago[dead]
- elevaet 3y agoBlue LEDs, like optical dental drills gouging their nasty hue onto retinas.
- nine_k 3y agoA tiny bit of duct tape works wonders.
- culopatin 3y agoDuct tape? Why so hardcore? Who wants to deal with the leftover glue they leave on whatever you taped?
- jack_riminton 3y agoI especially appreciate them on devices that are intended to be used on bedside tables
- somedude895 3y agoI went to shop for a wireless charging pad for my phone and two out of five had a power indicator LED on them. My god.
- NicoJuicy 3y agoEuh, then you know you're phone is connected and charging... Edit: well, that info is also on the phone. But i have charging pads and those LEDs were clearer / easier.
- ge96 3y agoSo to fix it do they isolate part of the electronics from main power?... Add more caps Oh yeah someone else mentioned caps hmm
- throwaway290 3y agoMitigation: replace them with incandescent bulbs.
- red-iron-pine 3y agothen you'd use an IR camera to track tiny thermal spikes to make similar guesses
- deleted 3y ago[deleted]
- withinboredom 3y agoNext up, capturing private keys by monitoring the slight power differences in wifi broadcasts. (effectively the same thing, just different wave-lengths of light and you don't need to be as close to it)
- quenix 3y agoCan't we just do this with an antenna? The issue is that the private keys are likely not being sent as cleartext.... no?
- themoonisachees 3y agoThe joke was that you're not parsing the wifi frames, you're just looking at infinitesimal changes in the broadcast power/frequency. Of course I don't think this is viable in the real world but in a perfect environment it should work.
- lyu07282 3y agoIt's also just called tempest, it's mostly a nsa thing. They can eavesdrop on crypto from across the street, well that was in the 50s, thats what we learned about 40 years later, god only knows what they can do today. I would link something, but there isnt even anything useful about it on the internet, that google can find anyway.
- nyanpasu64 3y agoI find that solar panels have very fine time resolution as well. When illuminated by the light coming from a CRT monitor and plugged into a 192khz motherboard audio interface, they were able to clearly resolve individual scanlines at 31.5 KHz, each with a sharp illumination peak falling off over microseconds to milliseconds. And IMO plugging a solar panel into an audio jack or cxadc (cheap high-speed 1-channel capture card) is about as realistic as filling a camera sensor frame with a LED's direct light (unsure if indirect reflections are bright enough). In terms of cameras, I suspect my Pixel 4a's rolling shutter isn't truly continuous, but has blocks of 4 or so "scanlines" (haha) which start and stop recording light simultaneously.
- was_a_dev 3y agoAt that point a cheap photodiode would be more sensitive and have higher temporal resolution
- paweladamczuk 3y agoFor those wondering how they could fill the entire frame with the LED when the webcam was 16 meters away: the webcam had 25x optical zoom.
- ETH_start 3y agoThis is why I believe there is absolutely no need for laws against public use of strong encryption. A great number of side-channel attacks exist to defeat encryption, that state actors can employ against high value targets. The state is massively more powerful than non-state actors, and that advantage does not need to be added to with laws restricting the public's access to strong encryption.
- nottorp 3y agoThis is fun, but it's missing the obligatory xkcd: https://xkcd.com/538/ https://xkcd.com/538/