2019/06/30 by Joe Loughry, Loughry, Joe
Computer Science · #Physical Unclonable Functions (PUFs) and Hardware Security #Cryptographic Implementations and Security #Advanced Malware Detection Techniques
paper · pdf · doi:10.48550/arxiv.1907.00479
It is possible to attack a computer remotely through the front panel LEDs.\nFollowing on previous results that showed information leakage at optical\nwavelengths, now it seems practicable to inject information into a system as\nwell. It is shown to be definitely feasible under realistic conditions (by\ninfosec standards) of target system compromise; experimental results suggest it\nfurther may be possible, through a slightly different mechanism, even under\nhigh security conditions that put extremely difficult constraints on the\nattacker. The problem is of recent origin; it could not have occurred before a\nconfluence of unrelated technological developments made it possible.\nArduino-type microcontrollers are involved; this is an Internet of Things (IoT)\nvulnerability. Unlike some previous findings, the vulnerability here is\nmoderate---at present---because it takes the infosec form of a classical covert\nchannel. However, the architecture of several popular families of\nmicrocontrollers suggests that a Rowhammer-like directed energy optical attack\nthat requires no malware might be possible. Phase I experiments yielded\nsurprising and encouraging results; a covert channel is definitely practicable\nwithout exotic hardware, bandwidth approaching a Mbit/s, and the majority of\ndiscrete LEDs tested were found to be reversible on GPIO pins. Phase II\nexperiments, not yet funded, will try to open the door remotely.\n