3 ms·
I love that Shamir keeps doing work that makes people say "... this can't be true!" Once again, this is a reminder that any adversary that has physical access
by sillysaurus2 13y ago
I love that Shamir keeps doing work that makes people say "... this can't be true!"
Once again, this is a reminder that any adversary that has physical access to your box can extract all your secrets, and there's almost nothing you can do about it.
For defending against acoustic attacks when encrypting/decrypting/typing in your password, play loud music. I recommend "What does the fox say?" by Ylvis since it has a wide range of powerful frequencies.
(There are other types of physical attacks than acoustic attacks, so this is more tongue in cheek than a real defense mechanism.)
- kevingadd 13y agoTo be clear, it's my understanding that playing music or generating artificial noise won't actually do much to stop this attack. Listening to some good tunes will definitely help distract you from worrying about attackers stealing your private keys, though!
- sillysaurus2 13y agoHeh. Even loud music? Why not? Now I really want to repeat Shamir's experiment with Gangnam Style blaring just to see what would happen.
- Houshalter 13y agoIf I understand correctly, it's because the frequency it is listening to is much higher than normal music. Also possibly because the algorithm is meant to deal with noise.
- nemesisj 13y agoI wonder if you couldn't just find some kind of white noise emitter that randomly generates noise for the frequencies in the same band?
- drakaal 13y agoActually it is because it is all fake, so he can set whatever rules he wants. If you are listening for sounds higher than "normal music" you can't capture them with a standard mic, let alone the mic on your phone, since it is optimized for vocal range.
- Crito 13y agoWhat about running 'loud processes' on other processors?
- icegreentea 13y agoIt depends on which attack vector you're defending against. If you're trying to defend against the cellphone (or chasis microphone) attack vector, then you can defintely defend with human audible noise. Your cellphone is going to have an aggressive low pass filter prior to the ADC to prevent aliasing. This will limit the cellphone range to roughly human audible range. The difficulty is in generating sufficient noise at the frequencies required. As the FAQ on the page points out the majority of this lies in +10kHz, so using normal music won't be too effective, but artificial noise is certainly possible. The Q&A on the linked site answers all sorts relevant questions and is quite enlightening. In the actual paper is maddening non-specific about how widespread audible range attacks are. Ultrasonic attacks are likely viable against nearly all unprotected machines, however the paper only says that 'some' machines are vulnerable to audible spectrum attacks.