Side Channel Attacks on Smartphones and Embedded Devices using Standard Radio Equipment

Transcription

1 Side Channel Attacks on Smartphones and Embedded Devices using Standard Radio Equipment Gabriel Goller & Georg Sigl

2 Introduction Device Under Test Sensor Radio Receiver Front End Software Defined Radio Signal Processing Capture the electromagnetic emanations of a device with state of the art radio equipment to use them for a side channel attack Public 2

3 Experimental Setup - Hardware FPGA - Xilinx Spartan 3A Digital Down Conversion RISC Micro Controller 1 MS/s A/D Converter Daughterboard Decimation Antenna 2 Antennas: Log-P and Bi-Quad ESN test receiver with preamplifier High-end setup using USRP N21 connected to IF of ESN DVB-T stick as low-cost alternative Network Driver Data Stream Control Ethernet Public 3

4 Experimental Setup - Software UHD: USRP Source Sample Rate: Rational Resampler 25 MS/s Band Reject Filter Decimation:1 Gain: 5 Low Pass Filter Complex to Mag/Arg File Sink GNURadio to process and record data Octave for offline post-processing Public 4

5 Device under Test - Software Encryption: c = m e mod N Plaintext m Ciphertext c Decryption: m = c d mod N f u n c t i o n square and m u l t i p l y ( c, d, N ) r e s u l t = 1 f o r each b i t ( d ) from ( number_of_bits ( d ) 1) downto r e s u l t = square ( r e s u l t ) mod N if bit(d) == 1 result = (c * result) mod N ėnd if end f o r r e t u r n r e s u l t end f u n c t i o n Simple Square & Multiply Algorithm implemented with Android NDK using functions provided by OpenSSL Public 5

6 Device under Test - Hardware Android-based smartphone with ARM architecture Removed shielding plate for stronger emanations Public 6

7 Finding Emanations 85 7 sdut sdut + sothers Amplitude(sDUT + sothers) [db] Amplitude(sDUT) [db] Amplitude [db] Frequency [MHz] Frequency [MHz] Measurements using Frequency Sweep (left diagram) Measurements using Nearfield Probe (right diagram) Educated Guessing Public 7

8 1667 ms Display Dependent 4 3 Cursor blinks every 5 s Cursor does not blink 31 Tap on touchscreen 5 times Do not touch touchscreen normalized Amplitude normalized Amplitude normalized Amplitude Time [ms] Time [s] Time [s] Changes of display content and contact with display can be measured from a distance of 3 m No correlation with program flaw Public 8

9 CPU Dependent normalized Amplitude normalized Amplitude Time [ms] Time [ms] A signal which correlates with the program flow can be found when the clock frequency of the CPU is set to a fixed value No SPA possible Public 9

10 Post-Processing of Signals Steps: Record signal with multiple S&M executions with same secret key d Extract each trace t where algorithm is executed (automated) Compute y(t) = mean(t 1 (t), t 2 (t), t 3 (t), ) normalized Amplitude Time [ms] Automated averaging of multiple signal blocks makes it possible to extract key of S&M algorithm Public 1

11 Evaluation - Number of Traces Correlation(x i, x5) 999 normalized Amplitude i Time [ms] y(i) = corr[mean(t 1, t 2,, t 5 ), mean(t 1, t 2,, t i )] 17 traces are sufficient to reconstruct key Public 11

12 Evaluation - Distance & Shielding Plate 45 4 Mean Amplitude of Signal Amplitude of Noise 185 Distance: 2cm, Traces: 881 Distance: 8cm, Traces: Normalized Amplitude Amplitude, 8cm Amplitude, 2cm Distance [m] Time [ms] 38 Signal measurable up to a distance of 15 m Number of traces increases, reconstruction succeeded at a maximal distance of 8 cm using 1894 traces Reaffixing shielding plate results in similar effects Public 12

13 Number of Traces II 1 High-End-Setup High-End-Setup with Shield High-End-Setup at distance of 8cm corr(mean(t1, t2,, t i), mean(t1, t2,, tq) i/q Shielding: Correlation of 999 with 276 traces ( factor 16) Distance: Correlation of 999 with 153 traces ( factor 9) Public 13

14 Evaluation - Lowcost Setup High-End-Setup High-End-Setup with Shield High-End-Setup at Distance of 8cm Low-End Setup 17 corr(mean(t1, t2,, ti), mean(t1, t2,, tq)) normalized Amplitude i/q Time [ms] Reduced costs of under 3 Signal-to-noise ratio decreased from 1394 db to 1182 db Correlation of 999 with 346 traces ( factor 2) Public 14

15 Evaluation - Miscellaneous Device OS CPU Attack Remove Orientation Frequency possible? Shielding? DUT 1 Android 9 MHz Yes Yes Smartphone DUT 2 Android 1 MHz Yes No Smartphone DUT 3 Android 1 MHz Yes Yes Smartphone DUT 4 Android 1 MHz Yes No SBC DUT 5 SBC Linux 9 MHz Yes No 5 different devices were tested, all with the same results The smartphone also emits signals when disassembled Public 15

16 Summary SCA on smartphones and embedded devices are feasible using standard radio equipment The experimental setup can be built for less than 3 A private key can be extracted with only 17 traces Attack was successfully conducted on multiple devices Public 16

17 Demo - Lowcost Setup f u n c t i o n square and m u l t i p l y ( c, d, N ) r e s u l t = 1 f o r each b i t ( d ) from ( number_of_bits ( d ) 1) downto r e s u l t = square ( r e s u l t ) mod N i f b i t ( d ) == 1 r e s u l t = ( c * r e s u l t ) mod N end i f ṡleep() end f o r r e t u r n r e s u l t end f u n c t i o n Public 17