Side channel attacks

1,721 views

Published on

second presentation on IT Security.

Published in: News & Politics, Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
1,721
On SlideShare
0
From Embeds
0
Number of Embeds
3
Actions
Shares
0
Downloads
44
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide
  • Not to be confused with social engineering
  • * 2 guys from Stanford University * timming usualy performed on smartcard reader * a lot of math and graphs
  • * Each key sounds different * University of Berkeley * September 2005 * use of statistics: the more likely then tjw
  • * March 2011 * works from 2 meters away
  • Cache as RAM
  • Side channel attacks

    1. 1. Side-Channel Attacks Stefan FODOR(backb0ne fl00d3r ) 1 day before June 'couse the true 1337 hax0rs don't care about vulnerabilities
    2. 2. Overview <ul><li>What is side channel attack
    3. 3. Classes of side channel attack
    4. 4. Examples
    5. 5. Countermeasures
    6. 6. Questions? </li></ul>
    7. 7. Side Channel Attacks <ul><li>Attack on cryptosystem
    8. 8. Informations gained from the physical implementation </li><ul><ul><li>Not brute-force
    9. 9. Nor known vulnerabilities </li></ul></ul><li>Requires advances knowledges </li><ul><ul><li>Hurraaayy.. no script kiddies! </li></ul></ul></ul>
    10. 10. Classes <ul><li>Timing attacks
    11. 11. Power monitoring attacks
    12. 12. Electromagnetic attacks
    13. 13. Acoustic cryptoanalysis
    14. 14. Differential fault analysis </li></ul>
    15. 15. OpenSSL attack <ul><li>Timing attack
    16. 16. Apache + mod_SSL
    17. 17. Compared time needed to decrypting multiple requests
    18. 18. They deduced multiple 1024 bit private-key </li></ul>
    19. 19. Acoustical spying <ul><li>10 minutes sound of user typing on a keyboard
    20. 20. Bad : recovered 96% of the text based on audio
    21. 21. Worse : 69% of all 10 random character password
    22. 22. Worst : works on ATMs, too </li></ul>
    23. 23. Smartphone eBanking <ul><li>Implemented as a proof-of-concept
    24. 24. Monitor the electromagnetic field of the smart-phone performing encryptions
    25. 25. Deduces the encryption key </li></ul>
    26. 26. Cold boot attack <ul><li>Personal favorite
    27. 27. Recover the disk encryption key
    28. 28. … after freezing the RAM Memory
    29. 29. Released in July 2008, still no decent remedy </li></ul>
    30. 30. <ul>Countermeasures </ul><ul><li>Depends on the system </li><ul><ul><li>And the attack predisposed to </li></ul></ul><li>You can't beat the hacker's imagination </li></ul>
    31. 31. Questions?
    32. 32. Resources <ul><li>http://www.networkworld.com/community/node/58989
    33. 33. http://en.wikipedia.org/wiki/Side_channel_attack
    34. 34. http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml
    35. 35. http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
    36. 36. http://citp.princeton.edu/memory/
    37. 37. http://www.youtube.com/watch?v=4L8rnYhnLt8 </li></ul>

    ×