('Oops! Had the silly thing in reverse')---Optical injection attacks in through LED status indicators
| Autor: | Joe Loughry |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
FOS: Computer and information sciences
021110 strategic defence & security studies Computer Science - Cryptography and Security Computer science Bandwidth (signal processing) 0211 other engineering and technologies Covert channel 020206 networking & telecommunications 02 engineering and technology Information security Computer security computer.software_genre Microcontroller Megabit Front panel K.6.5 Information leakage 0202 electrical engineering electronic engineering information engineering Malware computer Cryptography and Security (cs.CR) |
| DOI: | 10.48550/arxiv.1907.00479 |
| Popis: | It is possible to attack a computer remotely through the front panel LEDs. Following on previous results that showed information leakage at optical wavelengths, now it seems practicable to inject information into a system as well. It is shown to be definitely feasible under realistic conditions (by infosec standards) of target system compromise; experimental results suggest it further may be possible, through a slightly different mechanism, even under high security conditions that put extremely difficult constraints on the attacker. The problem is of recent origin; it could not have occurred before a confluence of unrelated technological developments made it possible. Arduino-type microcontrollers are involved; this is an Internet of Things (IoT) vulnerability. Unlike some previous findings, the vulnerability here is moderate---at present---because it takes the infosec form of a classical covert channel. However, the architecture of several popular families of microcontrollers suggests that a Rowhammer-like directed energy optical attack that requires no malware might be possible. Phase I experiments yielded surprising and encouraging results; a covert channel is definitely practicable without exotic hardware, bandwidth approaching a Mbit/s, and the majority of discrete LEDs tested were found to be reversible on GPIO pins. Phase II experiments, not yet funded, will try to open the door remotely. Comment: 7 pages, 7 figures. To appear in EMC Europe 2019 (Barcelona, Spain) |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|