Forgot your password?

Close
typodupeerror
Security IT

Time Machines, Computer Memory, and Brute Force Attacks Against Smartcards 49

Posted by Unknown Lamer
from the one-too-many-questions dept.
An anonymous reader writes "IEEE Spectrum reports on a method that exploits the decaying contents of unpowered computer memory to create an hourglass-like 'time machine' that rate limits brute force attacks against contactless smartcards and RFIDs. The paper takes an odd twist on the 'cold boot' attack reported four years ago at USENIX Security. Not quite as cool as a hot tub time machine though. " Full paper (PDF).
This discussion has been archived. No new comments can be posted.

Time Machines, Computer Memory, and Brute Force Attacks Against Smartcards More

Time Machines, Computer Memory, and Brute Force Attacks Against Smartcards

Comments Filter:

  • Re:What? (Score:5, Informative)

    by Baloroth (2370816) on Monday August 06, 2012 @11:25PM (#40901733)
    SRAM looses coherency in a statistically predictable pattern for a few seconds/minutes after it looses power. That means an otherwise powerless and clockless RFID chip can detect when it was powered on recently, and deny access attempts until at least a few seconds after the last access, rendering brute-force attempts vastly less practical (those normally use thousands of access attempts a second). Also, potentially annoying the hell out of anyone for whom the card doesn't work the first time, but security has always been a tradeoff with practicality (and if it is just a matter of seconds, not a huge deal).

  • Re:Neat trick... (Score:4, Informative)

    by Baloroth (2370816) on Monday August 06, 2012 @11:47PM (#40901853)

    If the attacked has lengthy, exclusive access to the chip and sufficiently advanced resources, basically nothing will stop them cracking it. This technique is simply a software added trick that can be used with cheap existing RFID technology to prevent drive-by attacks, not dedicated cracking. The key is "cheap": nearly free, in fact, rather than a more complicated method (my first thought was to use a simple RCI circuit to detect if the card has had power in the last few seconds to achieve the same effect as this, but that of course would add complexity and cost and most importantly couldn't be used with existing chips. Also potentially crackable, but it would help).

Advancement in position.

Close