New research at Tel Aviv University (Israel) might just take out the
'heroism' out of being a hacker or a cracker. A team of researchers has
developed a technique that lets you steal data from a laptop just by
'touching it'. All you need to do is wear a special wristband and touch
the exposed part of the machine that you want to victimize. The
wristband will measure all the minute changes in the ground electric
potential and figure out encryption keys. You can touch the machine with
your bare hands or with a wire.
In their research paper, to be presented at the CHES 2014, the researchers will describe how they were able to extract 4096-bit RSA keys and also 3072-bit ElGamal keys from the test machine. They say that though the machines work at GHz scale frequencies, a full blown attack will require just a few seconds to measure the frequencies using Medium Frequency signals ~2 MHz. The attack would require about an hour, if Low Frequency signals are used ~40 KHz. The team could extract keys from several test machines running a popular open source encryption software called GnuPG, which implements the OpenPGP standard.
The good news is that there's nothing to worry about just yet. The technique has all the focus on the encryption software. While GnuPG's got a patch ready to fix the problem to some level; the crackers will have to monitor the electricity changes during the decryption process to get hold of your data - which isn't quite easy.
In their research paper, to be presented at the CHES 2014, the researchers will describe how they were able to extract 4096-bit RSA keys and also 3072-bit ElGamal keys from the test machine. They say that though the machines work at GHz scale frequencies, a full blown attack will require just a few seconds to measure the frequencies using Medium Frequency signals ~2 MHz. The attack would require about an hour, if Low Frequency signals are used ~40 KHz. The team could extract keys from several test machines running a popular open source encryption software called GnuPG, which implements the OpenPGP standard.
The good news is that there's nothing to worry about just yet. The technique has all the focus on the encryption software. While GnuPG's got a patch ready to fix the problem to some level; the crackers will have to monitor the electricity changes during the decryption process to get hold of your data - which isn't quite easy.
No comments:
Post a Comment