Side-channel Threats Research Articles

Using KNX-Based Building Automation and Control Systems for Data Exfiltration

When it comes to protecting confidential and/or sensitive information, organizations have a plethora of recommendations, standards, policies and security controls at their disposal, conceived to deal with a wide variety of threats. However, most of them share the same fundamental premise: that weaknesses are inline by nature, as a consequence of infrastructure, social and/or technological gaps that can be detected, controlled, mitigated or constrained. Side channel threats are a different matter, though. Stemming from unconventional intrusion or attack vectors whose existence was inconceivable, unexpected or deemed unfeasible, their successful exploitation may provide attackers with the means to bypass and render most security controls ineffective or even useless. In this paper we address one such case: the use of a KNX-based building automation and control system to exfiltrate data from an air-gapped infrastructure. The introduction of a small device provides connectivity to the existing KNX fieldbus and enables sending data through it or even control other devices, with no interference in the operation of the building automation and control network. We validated the feasibility of this approach by means of an experimental setup, which was used to successfully evaluate two different techniques: inline bus exfiltration and optical transmission, via dimmer control. Finally, some measures for detecting and mitigating this type of attacks are proposed.

Microarchitectural Side-Channel Threats, Weaknesses and Mitigations: A Systematic Mapping Study

Microarchitectural Side-Channel Threats, Weaknesses and Mitigations: A Systematic Mapping Study

USB powered devices: A survey of side-channel threats and countermeasures

Abstract Recent technological innovations lead to the rise of a plethora of portable electronic devices such as smartphones, small household appliances, and other IoT devices. To power or recharge the battery of such devices, manufacturers identified in the ubiquitous Universal Serial Bus (USB) standard a convenient solution, as it enables both communication and energy supply. Unfortunately, the default trust on USB ports has been exploited by hackers to extract highly sensitive user data on such devices. Despite the efforts by security experts and manufacturers to detect and block this threat, an even more stealthy approach to undermine users privacy relies on side-channel attacks on the USB interface, such as electromagnetic emissions and power consumption. In this paper, we present a comprehensive survey of the state-of-the-art of side-channel analysis on the security of USB-powered devices. Differently from other surveys on USB-based attacks via the communication interface only, this survey considers research works that aim to infer or extract private information from the energy supply, the device itself, or unintentionally available functionalities. In particular, we consider this emergent trend of security work that was not previously considered in other surveys, such as the energy consumption and electromagnetic emission analyses, as well as Juice Filming Charging (JFC) attacks. We first analyze the physical properties of the side-channels and technical characteristics of such research work, we then summarize the countermeasures proposed in the state-of-the-art. Finally, we also identify some possible future directions to foster further research in this field.

HANMRE - An authenticated encryption secure against side-channel attacks for nonce-misuse and lightweight approaches

Side-channel threat is a form of cryptanalysis that takes advantage of secret information leaked during program implementations, through measurement and evaluation of systematic parameters, such as execution time, power consumption and electromagnetic field (EMF) radiation. Since various side-channel analysis techniques have applied successfully in gathering data and extracting cryptographic keys on variety of devices and platforms, including smartphones, smart cards, tablets, TVs, FPGAs and CPUs, these attacks constitute a significant risk to the security of cryptographic systems. Eliminating serious leakages is a major approach to mitigate side-channel vulnerabilities, in particular Simple Power Analysis (SPA) and Differential Power Analysis (DPA). During the last decade, several research aimed at securing cryptographic primitive algorithms against side-channel attacks, and validating possible countermeasures under assumption which its computational complexity can be estimated precisely. In this paper, we propose a hash-based authenticated nonce-misuse resistant encryption, namely HANMRE which is adaptable for a lightweight leakage resilient authenticated encryption with associated data (AEAD) scheme. The HANMRE construction has been designed for the side-channel security achievement (including SPA and DPA attacks) and highly integrated for restrained environments with limited resource. The advantage of this scheme is ensuring the strong security developed in misuse-resistant schemes against general adversaries for authenticated encryption [1]. It also presents reasonable implementation results (especially long message handling) compared to existing authenticated encryption schemes and is expected to be a novel idea for better approaches of authenticated encryption mechanisms design in the future.

Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX.

Side-channel risks of Intel's SGX have recently attracted great attention. Under the spotlight is the newly discovered page-fault attack, in which an OS-level adversary induces page faults to observe the page-level access patterns of a protected process running in an SGX enclave. With almost all proposed defense focusing on this attack, little is known about whether such efforts indeed raises the bar for the adversary, whether a simple variation of the attack renders all protection ineffective, not to mention an in-depth understanding of other attack surfaces in the SGX system. In the paper, we report the first step toward systematic analyses of side-channel threats that SGX faces, focusing on the risks associated with its memory management. Our research identifies 8 potential attack vectors, ranging from TLB to DRAM modules. More importantly, we highlight the common misunderstandings about SGX memory side channels, demonstrating that high frequent AEXs can be avoided when recovering EdDSA secret key through a new page channel and fine-grained monitoring of enclave programs (at the level of 64B) can be done through combining both cache and cross-enclave DRAM channels. Our findings reveal the gap between the ongoing security research on SGX and its side-channel weaknesses, redefine the side-channel threat model for secure enclaves, and can provoke a discussion on when to use such a system and how to use it securely.

Using Power Clues to Hack IoT Devices: The power side channel provides for instruction-level disassembly

The field of consumer electronics (CE) has gone digital, inheriting all the security problems of the digital world in the process. The Internet of Things (IoT) class of CE devices is still in a very early adoption phase. Physical side channels are a bigger vulnerability for this class of devices than traditional security threats that exploit protocol, algorithm, or program weaknesses. Interestingly, the assembly-level program executing within a device can be reconstructed only through power sidechannel observations. This instruction-level disassembly is an emerging power side-channel threat.

Optimal Hamming Distance Model for Crypto Cores against Side Channel Threats

Optimal Hamming Distance Model for Crypto Cores against Side Channel Threats

Optimal Hamming Distance Model for Crypto Cores against Side Channel Threats

Microelectronic crypto devices contain intellectual property like secret data to be protected against side channel attack. Scan chain based attacks come under the category of side channel attack where the hackers attack a scan path through observing and comparing the relationship between intermediate hamming distances values for different test vector patterns. Hence our novel hamming model should overcome the scan based attack and should not give any correlation relationship in hamming distance by providing the similar intermediate values for all test vector patterns which are obtained through an optimal way of inserting Optimal Scan Flip Flop (OSFF) randomly to the scan path chain. Implementation of our proposed integrated circuits is written in Verilog and synthesised with XILINX Spartan III FPGA. The report is compared with Robust Scan Flip Flop (RFSS) hamming model to estimate the overhead of component minimized in OSFF.