https://www.nassiben.com/video-based-crypta
"TLDR: We were able to recover secret keys from non-compromised devices using
video footage of their power LED obtained by commercial video cameras.
In this paper, we present video-based cryptanalysis, a new method used to
recover secret keys from a device by analyzing video footage of a device’s
power LED. We show that cryptographic computations performed by the CPU change
the power consumption of the device which affects the brightness of the
device’s power LED. Based on this observation, we show how attackers can
exploit commercial video cameras (e.g., an iPhone 13’s camera or
Internet-connected security camera) to recover secret keys from devices. This
is done by obtaining video footage of a device’s power LED (in which the frame
is filled with the power LED) and exploiting the video camera’s rolling shutter
to increase the sampling rate by three orders of magnitude from the FPS rate
(60 measurements per second) to the rolling shutter speed (60K measurements per
second in the iPhone 13 Pro Max). The frames of the video footage of the
device’s power LED are analyzed in the RGB space, and the associated RGB values
are used to recover the secret key by inducing the power consumption of the
device from the RGB values. We demonstrate the application of video-based
cryptanalysis by performing two side-channel cryptanalytic timing attacks and
recover: (1) a 256- bit ECDSA key from a smart card by analyzing video footage
of the power LED of a smart card reader via a hijacked Internet-connected
security camera located 16 meters away from the smart card reader, and (2) a
378-bit SIKE key from a Samsung Galaxy S8 by analyzing video footage of the
power LED of Logitech Z120 USB speakers that were connected to the same USB hub
(that was used to charge the Galaxy S8) via an iPhone 13 Pro Max. Finally, we
discuss countermeasures, limitations, and the future of video-based
cryptanalysis in light of the expected improvements in video cameras’
specifications."
Via Jerry Leichter and Dave Farber, who wrote “Side channels strike again”
Security is hard.
Cheers,
*** Xanni ***
--
mailto:xanni@xanadu.net Andrew Pam
http://xanadu.com.au/ Chief Scientist, Xanadu
https://glasswings.com.au/ Partner, Glass Wings
https://sericyb.com.au/ Manager, Serious Cybernetics
