Screaming Channels Attack RF Security

guest · Jul 29, 2018

Screaming Channels Attack RF Security
July 27, 2018
https://hackaday.com/2018/07/27/screaming-channels-attack-rf-security/

The attack relies on the ubiquitous use of mixed-signal ICs to make cheap radios like Bluetooth dongles. They call it “Screaming Channels” and — in a nutshell — it is relying on digital information leaking out on the device’s radio signal.

Does it work? The team claims to have recovered an AES-128 key from 10 meters away.

Some work had already been done on recovering a key when an attacker can measure the power using something like ChipWhisperer, and the team was able to leverage that work. Unlike ChipWhisperer, however, Screaming Channels doesn’t require a physical connection to the device.
Click to expand...

Related:
Boffins: Mixed-signal silicon can SCREAM your secrets to all
July 27, 2018
https://www.theregister.co.uk/2018/07/27/screaming_channels_attack/

Unlike more esoteric side-channels, which often need physical access to a target machine or some kind of malware implant, this leak comes from radio devices working as intended by the maker. If an SoC packs analogue and digital operations on the same die, the CPU's operations inevitably leak to the radio transmitter, and can be traced from a distance.

With a trace captured and cleaned up, the researchers wrote, pre-existing key-recovery tools like https://newae.com/tools/chipwhisperer/ ChipWhisperer recovered the AES encryption keys with only small modifications.

The group has published its paper here, and its code is available at GitHub.

The paper will be presented at BlackHat in August, and at the ACM's Conference on Computer and Communications Security in October.
Click to expand...

Log in or Sign up

Screaming Channels Attack RF Security

guest Guest

Log in or Sign up

Screaming Channels Attack RF Security

guest Guest

Useful Searches