4 ms·

> Q: Why do attackers need to obtain video footage filled with the LED of the target device? > A: Cryptanalysis requires a high sampling rate. > By filling th

> Q: Why do attackers need to obtain video footage filled with the LED of the target device? > A: Cryptanalysis requires a high sampling rate. > By filling the frame with the LED, attackers exploit the rolling shutter to increase the number of measurements of the color/intensity of the LED by three orders of magnitude from the FPS rate (60 measurements per second) to the rolling shutter's speed (60K measurements per second in iPhone 13 Pro Max). A sampling rate of 60k can provide the needed sampling rate to attack functional IoT devices (smartphones, smartcards, TV streamers, etc.). Using a single frame captured with rolling shutter as a 1-bit high-framerate video. Very cool technique!

detrites 3y ago
This is very cool, but I can't understand how 60khz is enough resolution to usefully discern what would be happening inside a CPU, etc, that's running way faster than that? (Disclaimer: I can't read the article as it says "browser not supported".) EDIT - Answered here: https://news.ycombinator.com/item?id=36332352 https://news.ycombinator.com/item?id=36332352
- dfox 3y ago
  The idea is that in typical assymetric cryptosystem you do some variant of bitwise exponentation of “large values” (ie. slow) and both the power envelope and timing is directly related to individual bit values of the private key. This trivially works for RSA and also anything involving integer-like groups and then even for “classic” ECC, things like 25519 are intentionally designed to mitigate this kind of side channel.
gugagore 3y ago
http://people.csail.mit.edu/mrub/VisualMic/ http://people.csail.mit.edu/mrub/VisualMic/ uses the rolling shutter to get audio from regular-framerate video of a bag of chips.
- tecleandor 3y ago
  In that paper they use a "regular" high framerate camera. Those cameras are usually low resolution. I guess what could be more interesting or practical: Low-res very high FPS, or very high resolution, and regular/high FPS (having more pixels would give you more sampling opportunities...).
  - gugagore 3y ago
    They use both.
  - dmurray 3y ago
    In five years our budget-level Android phones will have both!
    - tecleandor 3y ago
      I'm not super convinced about that. The (raw) quality in the phones sensors hasn't climbed as quickly as on dedicated cameras this last years. The secret sauce for today's phone's cameras is a lot of processin, and if you get an unprocessed photo from a current day phone-size sensor is almost as bad as one from yeeears ago. And that's OK for regular photos, but I guess is not that good if you want to do image or signal processing and your data has already gone through some other processing and a "IA".
      - Kirby64 3y ago
        Raw sensor size in cell phones has massively increased compared to years ago, and improvements in sensor technology (BSI, for instance) has improved performance of sensors of similar size. These did not exist before. Obviously processing is getting more powerful, but I think you're discounting the improvements in the space. There's a few notable exceptions (e.g., Pixel phones used the same kinda crappy sensor for many generations), but largely people keep using the newer, better sensor on flagship devices.
    - usrusr 3y ago
hyperthesis 3y ago
enhance!

detrites 3y ago

This is very cool, but I can't understand how 60khz is enough resolution to usefully discern what would be happening inside a CPU, etc, that's running way faster than that? (Disclaimer: I can't read the article as it says "browser not supported".) EDIT - Answered here: https://news.ycombinator.com/item?id=36332352 https://news.ycombinator.com/item?id=36332352

dfox 3y ago
The idea is that in typical assymetric cryptosystem you do some variant of bitwise exponentation of “large values” (ie. slow) and both the power envelope and timing is directly related to individual bit values of the private key. This trivially works for RSA and also anything involving integer-like groups and then even for “classic” ECC, things like 25519 are intentionally designed to mitigate this kind of side channel.

gugagore 3y ago

http://people.csail.mit.edu/mrub/VisualMic/ http://people.csail.mit.edu/mrub/VisualMic/ uses the rolling shutter to get audio from regular-framerate video of a bag of chips.

tecleandor 3y ago
In that paper they use a "regular" high framerate camera. Those cameras are usually low resolution. I guess what could be more interesting or practical: Low-res very high FPS, or very high resolution, and regular/high FPS (having more pixels would give you more sampling opportunities...).
- gugagore 3y ago
  They use both.
- dmurray 3y ago
  In five years our budget-level Android phones will have both!
  - tecleandor 3y ago
    I'm not super convinced about that. The (raw) quality in the phones sensors hasn't climbed as quickly as on dedicated cameras this last years. The secret sauce for today's phone's cameras is a lot of processin, and if you get an unprocessed photo from a current day phone-size sensor is almost as bad as one from yeeears ago. And that's OK for regular photos, but I guess is not that good if you want to do image or signal processing and your data has already gone through some other processing and a "IA".
    - Kirby64 3y ago
      Raw sensor size in cell phones has massively increased compared to years ago, and improvements in sensor technology (BSI, for instance) has improved performance of sensors of similar size. These did not exist before. Obviously processing is getting more powerful, but I think you're discounting the improvements in the space. There's a few notable exceptions (e.g., Pixel phones used the same kinda crappy sensor for many generations), but largely people keep using the newer, better sensor on flagship devices.
  - usrusr 3y ago

hyperthesis 3y ago

enhance!