Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security IT

Keys Leaking Through the Air At RSA 85

Posted by CmdrTaco from the patch-it-up dept.
NumberField writes "The RSA Conference is underway in San Francisco. A theme among the opening speakers is that the attackers are winning, and even well-funded organizations like NASDAQ can't secure their networks reliably. The show floor is lively, but dominated by the typical firewalls and 'compliance solutions.' One interesting exception is a scary side-channel analysis demo in the Cryptography Research booth using GNU Radio to capture secret keys from various smartphones from about 10 feet away. (The method is related to early computer music using AM radio interference.)"
This discussion has been archived. No new comments can be posted.

Keys Leaking Through the Air At RSA More

Keys Leaking Through the Air At RSA

Comments Filter:

  • Where's TFA? (Score:1)

    by Anonymous Coward

    None of the links seem to be to anything very specific about the title issue ("keys leaking through the air")... was something mispasted in the submission?

  • I fucking hate summaries like this (Score:5, Insightful)

    by topham ( 32406 ) on Tuesday February 15, 2011 @04:56PM (#35215204) Homepage

    I fucking hate summaries with a half dozen links that don't seem to link to an article actually discussing the issue in the summary.

    Why approved this shit?

  • Wondering how Arron Barr's presentation on Social Network went... Though I might post as "Anonymous Coward", but don't feel like having my door kicked in by the Fed's today.

    • Re: (Score:2)

      by c0lo ( 1497653 )

      Wondering how Arron Barr's presentation on Social Network went... Though I might post as "Anonymous Coward", but don't feel like having my door kicked in by the Fed's today.

      Searched [rsaconference.com] the RSA11 sessions: his presentation is nowhere to be found.

    • Re: (Score:1)

      by Anonymous Coward

      He cancelled his presentation of course, but they still have a booth at the RSA conference. Feel free to drop in and say 'hi'.

    • Re: (Score:1)

      by Anonymous Coward

      http://www.hbgary.com/statement.htm [hbgary.com]

      A group of aggressive hackers known as “Anonymous” illegally broke into computer systems and stole proprietary and confidential information from HBGary, Inc. This breach was in violation of federal and state laws, and stolen information was publicly released without our consent.

      In addition to the data theft, HBGary individuals have received numerous threats of violence including threats at our tradeshow booth.

      In an effort to protect our employees, customers and

  • why on earth... (Score:3)

    by joocemann ( 1273720 ) on Tuesday February 15, 2011 @05:12PM (#35215364)

    . are sensitive networks like NASDAQ even connected to the internet? There is a common fix for this issue called an AIR GAP. You simply physically disconnect the nternet from the sensitive technology, and then you work forward from there while always regarding the fundamental necessity of the air gap. It is, reckless and foolish considering the reality of the internet, to think you can connect and protect.

    • Re:why on earth... (Score:4, Informative)

      by jandrese ( 485 ) <kensama@vt.edu> on Tuesday February 15, 2011 @05:20PM (#35215480) Homepage Journal
      Because eTrade would throw a hissyfit if the stock exchanges were completely disconnected from the net. Not to mention all of the traders that no longer work directly on the floor, but instead issue trades via the network, often times using bots.

      • Re: (Score:1)

        by Anonymous Coward

        This requires a simple data transfer through a sterile line with extremely simple data types, not a full on connection to the network.

        • The issue for NASDAQ isn't the trivial task of securing their servers, it is establishing and maintaining a chain of trust to the remote clients wanting to authorize trades.

    • Re:why on earth... (Score:4, Interesting)

      by Mashiki ( 184564 ) <mashiki@gmail.cBALDWINom minus author> on Tuesday February 15, 2011 @05:30PM (#35215570) Homepage

      Because all trade networks connect to each other now, and the internet is the cheapest way than building dedicated hardlinks to innerconnect to all stock exchanges. I doubt that any exchange would be willing to drop billions to build trans-atlantic/pacific data exchanges, unless something catastrophic happened. Plus it creates central points of weakness.

      The internet 'routes around damage'.

      • Re: (Score:3)

        by mlts ( 1038732 ) *

        Ideally, the networks should be on a backbone which can piggyback over Internet connections, but by using half-routers that already know each other and use preshared symmetric keys (so even if RSA is broken, the communication going across the pipe is still secure unless someone hacks the endpoint.)

        The US government has learned this (NIPRNet and SIPRnet), maybe businesses need their own backbone that is separate from the Internet.

      • There is a middle ground between using the internet (where delivery is on a best effort basis and has no guarantees of anything) and laying your own submarine cables. Private international leased lines are readily available from a variety of vendors and are used extensively by financial institutions. They're available with various SLAs on contention, latency and uptime depending on how much you're willing to spend. Transatlantic routes are available surprisingly cheaply, as there is an abundance of bandwidt

      • Because all trade networks connect to each other now, and the internet is the cheapest way than building dedicated hardlinks to innerconnect to all stock exchanges. I doubt that any exchange would be willing to drop billions to build trans-atlantic/pacific data exchanges, unless something catastrophic happened. Plus it creates central points of weakness.

        The internet 'routes around damage'.

        Dedicated links are the only links which can be secured.
        It's worth it.

        And no, it doesn't necessarily give you a single point of failure, or "central points of wekaness" any more than the internet does.

        The worst case scenario for losing electronic trading is small delay in trades going through, thus killing off high frequency trading and forcing people to INVEST.
        This would be a GOOD THING.

        • Re: (Score:2)

          by Mashiki ( 184564 )

          And no, it doesn't necessarily give you a single point of failure, or "central points of wekaness" any more than the internet does.

          Oh I believe that dedicated links are worthwhile. The only question is what will happen, and how much money will be spent later. I'd call it human nature myself.

          As for a central point of weakness? Sure. All you need to do is look at past incidents where some ship(whether cargo/fisherman/idiot) dredges along and kills net access to 1/3 of the worlds population, or limits it.

        • Re: (Score:2)

          by nuggz ( 69912 )

          What is the problem with high frequency trading?

          I'm an investor, it provides more liquidity.
          It doesn't change the value of the stock, it at most causes slight minor price swings, which, with the use of limit orders doesn't affect me.

    • Re: (Score:3)

      by vux984 ( 928602 )

      . are sensitive networks like NASDAQ even connected to the internet?

      So you can get up to date stock quotes from yahoo, instead of waiting for them in the news paper?

      So you can log into your bank or brokerage and buy and sell shares of something?

      So brokers, fund managers, and so on can do the same, all in real-time from their offices around the world?

      Air gapping the stock exchange would be pretty inconvenient for pretty much anyone who deals with it at all.

      • Re: (Score:1)

        by c0lo ( 1497653 )

        Air gapping the stock exchange would be pretty inconvenient for pretty much anyone who deals with it at all.

        The use of Telepathy Control Protocol over Idiotic Precogs would solve this in a blink.
        Too bad the BoA seems to hold some patents on it - they used it to register in advance some domain names, so the rumors have it.
        (*duck*)

      • Air gapping it might be inconvenient, but it will make the market a whole lot better for you and me

        • Re: (Score:2)

          by vux984 ( 928602 )

          Air gapping it might be inconvenient, but it will make the market a whole lot better for you and me

          We can make the market a whole lot better for you and me without throwing the baby out with the bathwater.

          Being connected to the internet isn't the problem. If they pulled the nasdaq of the net and institutional traders simply dialed into it on dedicated T1/fiber lines totally air-gapped from the Internet it would have all the problems it has now... and it would take a broker charging $100+ per trade to execut

          • Meanwhile, volatility goes down and focus on longer term investments than milliseconds goes up. Both are good for the market considering what we've seen these past few years. The cutting edge of technology isn't always beneficial to people or even countries(as I'm sure Mubarak is saying right now).

          • Actually it's not common for exchanges to offer connectivity in via the internet except perhaps for low-traffic connections for integration testing and suchlike. The unpredictability of the internet makes it impossible for them to guarantee the service levels that are demanded. The constant stream of pricing updates can run into the gigabits per second depending on what you're subscribed to. If you're big enough to be trading directly on the exchange, the cost of the leased lines and/or colocation next to t

            • But those with the connections aren't likely to air gap them from the rest of their network.

            • Re: (Score:2)

              by vux984 ( 928602 )

              If you're big enough to be trading directly on the exchange, the cost of the leased lines and/or colocation next to the exchange (latency is everything) is easy to swallow.

              And as long as those leased lines and co-located servers are connected to the internet... ...Then the exchanges are connected to the internet.

    • Hmmm... Okay, but all the other servers that have to talk to it *are* connected to the internet. I know because I've set servers up before in their primary data center.

      So even if you keep all the NASDAQ servers on a private network only, you still have all the entry points from the physical ethernet drops throughout the data center going into all the cages (several thousands of them) of people routing orders onto NASDAQ.

      So when Joe Brokerage or John Trading Shop gets compromised, it's only a hop away to t

    • Re: (Score:1)

      by eyenot ( 102141 )

      didn 't you read the summary?

      the "air gap" has been closed within 10 feet of a person even/especially on the busy, crowded, everybody's-holding-a-palmtop NASDAQ floor.

    • And WalMart could eliminate shoplifting by building their stores without doors.

  • wtf is this article - is there actual content anywhere or is it an ad for the RSA conference?

  • Some background (Score:5, Informative)

    by Dr. JJJ ( 325391 ) on Tuesday February 15, 2011 @05:43PM (#35215688)

    I'm sorry that there's no direct article for this submission, and I'm not certain who submitted it, but as an employee of CRI and one of the designers of the demo, I'd like to give you some details about what's going on.

    At CRI we have a lab full of what I consider to be cool equipment, and what's more, some spare time to look at things. We specialize in side-channel analysis and we asked ourselves: what sort of side-channel leaks might be present in consumer PDAs? We took a USRP(1) interface that we had lying around and started investigating the RF emanations of a few of the devices we had easily on hand. We coded some simple cryptographic applications and were surprised at how quickly we were able to find ways to demodulate the various signals in the device in a way that revealed the bits of the secret keys being used.

    We are indeed using GNURadio for the demo. It's been very helpful because it makes rapid prototyping very easy. We use gnuradio-companion to set up the signal processing blocks (mostly AM demodulation) and to set up a simple UI that helps us tune into the right carrier frequencies in real-time during the demo. The rest of the demo involves using our own custom waveform viewer to look at the demodulated signal and show visitors how we can analyze the signal on the screen and extract the key bits that were used during the encryption/decryption process on the device.

    • mostly AM demodulation

      Amplitude Modulation demodulation?
      The avg person won't think twice about it, but us pedants can't help it.

      That aside, I'm not surprised that consumer software is blabbing its secrets all over the airwaves.
      Even for companies who spend millions on security Q&A for their software, they still manage to find new and innovative ways to screw it up.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        What's wrong with demodulating an amplitude modulated signal? How would you have phrased it differently without losing information?

    • The side-channel analysis was the most fascinating blurb in this article. Thanks for sharing how this works. Are all PDAs so RF noisy in their processing? Have you considered using this technique on some modern smart phones?

  • Couldn't you design the assemblies so the boards could be conformal coated with a dialectic layer and them potted with a RF absorbing layer and then a grounded layer as not be able to pick up the emissions in the first place.

    • Couldn't you design the assemblies so the boards could be conformal coated with a dialectic layer and them potted with a RF absorbing layer and then a grounded layer as not be able to pick up the emissions in the first place.

      I suppose you could, but it'd really ruin your reception. As long as you have the need for a functioning antenna connected to the device, stray signals will be received as well as transmitted. Not to mention that your idea would increase the build cost in a way that most manufacturers would deem "unnecessary".

  • TPM (Score:2)

    by Lehk228 ( 705449 )
    years ago i predicted that such attacks could be utilized to crack TPM keys and such, looks like my prediction was tending towards correct.

    • years ago i predicted that such attacks could be utilized to crack TPM keys and such, looks like my prediction was tending towards correct.

      These side-channel attacks have been known for years; the TPM guys know them too, and have likely at least made attempts to stymie them.

      • You may leave that "likely" out. Most of these TPA modules are modified smart card chips, and they certainly provide security against DPA attacks. The problem is that most general purpose CPU's do not. This becomes more of a problem if this chip is a low frequency, highly mobile RISC chip, I suppose.

        • The interesting thing about this is that the security protections in SC chips would be triviial to port to a larger IC CPU; you're get a bit of performance loss, but randomizing the pipelining would probably be enough for simple protection.

          So what you'd see is not too much cost involved in adding the protection, but a minor performance hit. Seems to me the Mobile market (where chips are usually underclocked anyway) would be the perfect market to start implementing this in. Gaming PCs probably don't need t

  • Gee, this takes me back. The IBM 1130 (actually IIRC a later clone) had a 'Winchester' (IBM model 3030) washingmachine-sized drive with a 5 HP stepping motor to drive the arm, and removable 5 MB disk packs. Somebody back in the mists of history figured out that if you put a transistor radio on top of the console in the right place, the disk controller signals that drove the stepping motor made enough EMI to generate an AM radio signal. So they wrote an assembler program that could play different songs ac

Slashdot Top Deals

As you will see, I told them, in no uncertain terms, to see Figure one. -- Dave "First Strike" Pare

Close