Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Researchers crack the worlds toughest encryption by listening to your computers CPU
#1
This sounds like PGP and other encryption systems must be under threat? If nit already cracked by the NSA/GCHQ nexus?

Quote:

Researchers crack the world's toughest encryption by listening to the tiny sounds made by your computer's CPU


[Image: acoustic-cryptanalysis-parabolic-microphone-640x353.jpg]

Share This Article






[COLOR=#04558B !important]252
in[COLOR=#333333 !important]Share[/COLOR]





Security researchers have successfully broken one of the most secure encryption algorithms, 4096-bit RSA, by listening yes, with amicrophone to a computer as it decrypts some encrypted data. The attack is fairly simple and can be carried out with rudimentary hardware. The repercussions for the average computer user are minimal, but if you're a secret agent, power user, or some other kind of encryption-using miscreant, you may want to reach for the Rammstein when decrypting your data.
This acoustic cryptanalysis, carried out by Daniel Genkin, Adi Shamir (who co-invented RSA), and Eran Tromer, uses what's known as a side channel attack. A side channel is an attack vector that is non-direct and unconventional, and thus hasn't been properly secured. For example, your pass code prevents me from directly attacking your phone but if I could work out your pass code by looking at the greasy smudges on your screen, that would be a side channel attack. In this case, the security researchers listen to the high-pitched (10 to 150 KHz) sounds produced by your computer as it decrypts data.
This might sound crazy, but with the right hardware it's actually not that hard. For a start, if you know exactly what frequency to listen out for, you can use low- and high-pass filters to ensure that you only have the sounds that emanate from your PC while the CPU decrypts data. (In case you were wondering, the acoustic signal is actually generated by the CPU's voltage regulator, as it tries to maintain a constant voltage during wildly varied and bursty loads). Then, once you have the signal, it's time for the hard bit: Actually making sense of it.
[Image: acoustic-cryptanalysis-cpu-instructions-640x489.png]Here you can see the frequency spectrogram of various CPU instructions (down the right hand side)

Without going into too much detail, the researchers focused on a very specific encryption implementation: The GnuPG (an open/free version of PGP) 1.x implementation of the RSA cryptosystem. With some very clever cryptanalysis, the researchers were able to listen for telltale signs that the CPU was decrypting some data, and then listening to the following stream of sounds to divine the decryption key. The same attack would not work on different cryptosystems or different encryption software they'd have to start back at the beginning and work out all of the tell-tale sounds from scratch.
The researchers successfully extracted decryption keys over a distance of four meters (13 feet) with a high-quality parabolic microphone. Perhaps more intriguingly, though, they also managed to pull of this attack with a smartphone placed 30 centimeters (12 inches) away from the target laptop. The researchers performed the attack on different laptops and desktops, with varying levels of success. For what it's worth, the same kind of electrical data can also be divined from many other sources the power socket on the wall, the remote end of an Ethernet cable, or merely by touching the computer (while measuring your body's potential relative to the room's ground potential).
[Image: acoustic-cryptanalysis-laptop-portable-s...40x247.jpg]In this light-weight setup, only the microphone (B) needs to be positioned correctly everything else could be hidden away, for stealthy snooping

In terms of real-world repercussions, acoustic cryptanalysis is actually surprisingly dangerous. Imagine if you were decrypting some files in a library, coffee shop, or other public space someone could obtain your decryption key just by placing their phone near your computer. Alternatively, an attacker could use spear phishing to put malware on yourphone that listens for the decryption key. With HTML5 and Flash able to access the microphone, it would be possible to build a website that listens for encryption keys too. The researchers propose one particularly nefarious scenario: Put a microphone into a co-located server, slot it into a rack in a data center, and then scoop up the encryption keys from hundreds of nearby servers.
If you want to keep your data secure, you only really have two viable options: Heavy-duty encryption, physical security, and ideally both at the same time. If an attacker can't get physically close to your data, it instantly becomes much harder to steal it. As far as mitigating acoustic cryptanalysis attacks, you either implement physical security keep your laptop in a sound-tight box, or never let anyone near your computer when you're decrypting data or you need to use a "sufficiently strong wide-band noise source." Something like a swooping, large-orchestra classical concerto would probably do it.

From Extremetech.com
[/COLOR]
The shadow is a moral problem that challenges the whole ego-personality, for no one can become conscious of the shadow without considerable moral effort. To become conscious of it involves recognizing the dark aspects of the personality as present and real. This act is the essential condition for any kind of self-knowledge.
Carl Jung - Aion (1951). CW 9, Part II: P.14
Reply
#2
I long ago assumed that PGP and similar were able to be cracked by NSA [if they wanted to put in the effort]. Supposedly, there are NO encryption protocols now [publicly known] that can evade the NSA - and anything they can NOT crack would make them MOST suspicious and they'd follow your every move and other detail of your life and try a physical attack [break in et al.] and/or theft of your computer[s] or putting in spyware to monitor your keystrokes etc to watch your encryption techniques or keys. None of us are safe anymore. Privacy is a thing of the past. ::fury:::Hitler:
"Let me issue and control a nation's money and I care not who writes the laws. - Mayer Rothschild
"Civil disobedience is not our problem. Our problem is civil obedience! People are obedient in the face of poverty, starvation, stupidity, war, and cruelty. Our problem is that grand thieves are running the country. That's our problem!" - Howard Zinn
"If there is no struggle there is no progress. Power concedes nothing without a demand. It never did and never will" - Frederick Douglass
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Researchers Map How Scientific Misinformation Spreads On The Internet Drew Phipps 2 6,331 10-01-2016, 03:13 PM
Last Post: Drew Phipps
  American Researchers Discover 'Stupidity Virus' Magda Hassan 0 3,579 14-11-2014, 01:30 PM
Last Post: Magda Hassan
  How Encryption Programs can be attacked Carsten Wiethoff 4 3,387 26-07-2013, 09:04 AM
Last Post: Peter Lemkin
  100 billion alien worlds Bernice Moore 0 2,775 14-01-2012, 03:41 PM
Last Post: Bernice Moore
  ... German Security Agencies Caught Planting Spyware on Private Computers Ed Jewett 0 3,005 16-10-2011, 10:32 PM
Last Post: Ed Jewett
  milky way stuffed with alien worlds... Bernice Moore 1 2,461 22-02-2011, 07:25 PM
Last Post: Peter Lemkin
  Detecting Photgraphic Fakes In The Time of Computers Peter Lemkin 22 15,669 07-12-2008, 02:01 PM
Last Post: Peter Lemkin

Forum Jump:


Users browsing this thread: 1 Guest(s)