Search

In the field of cybersecurity, the ability to gather detailed information about target systems is a critical component of the reconnaissance phase of cyber attacks. This phase, known as cybersecurity reconnaissance, involves techniques that adversaries use to collect information vital for the success of subsequent attack stages. Traditionally, reconnaissance activities include network scanning, sniffing, and social engineering, which allow attackers to map the network, identify vulnerabilities, and plan their exploits. In this paper, we explore a novel application of side-channel analysis within system-based reconnaissance. Side-channel attacks, typically used to extract cryptographic keys or sensitive data through indirect observations such as power consumption or electromagnetic emissions, are here repurposed for a different kind of system intrusion. Specifically, we demonstrate how side-channel analysis and machine learning techniques can classify running processes on a target system that are very popular in common IoT applications. This approach is particularly concerning for IoT environments where devices often control critical infrastructure or handle sensitive data. The ability to identify active applications can reveal operation patterns, system behaviors, and potential vulnerabilities that traditional security measures may not protect against. Moreover, in IoT scenarios, this information can be leveraged to orchestrate sophisticated attacks targeting specific services or to exploit timing-based vulnerabilities when certain critical applications are running. By categorizing this approach as a form of local system-based reconnaissance, we highlight its potential to silently gather critical information about a system’s state. Such capabilities represent a significant breach of privacy and provide attackers with the intelligence needed to carry out more targeted and effective attacks. This research also underscores the evolving nature of reconnaissance techniques and the growing risks of advanced side-channel cybersecurity methods.

The rise of the Internet of Things (IoT) technology during the past decade has resulted in multiple applications across a large variety of fields. Some of the data processed using this technology can be specially sensitive, and the devices involved can be prone to cyberattacks, which has resulted in a rising interest in the field of information security applied to IoT. This study presents a method for analyzing an IoT network to detect attacks using side-channel techniques that monitor the power usage of the devices. It shows that it is possible to employ a monitoring system powered by Machine Learning to detect intrusions without interfering with the normal behavior of the devices. Tests yield positive results under a range of scenarios, including using a custom dataset, detecting new attacks previously unseen by the models, and detecting attacks in real time. The main advantages of the proposed system are simplicity, reproducibility (both code and data are made available) and portability, since it can be deployed on all kinds of devices and does not have a high demand of resources. Several deployment strategies are proposed, depending on the structure of the target IoT network and the power constraints of the devices.

Over the course of recent years, microarchitectural side-channel attacks emerged as one of the most novel and thought-provoking attacks to exfiltrate information from computing hardware. These attacks leverage the unintended artefacts produced as side-effects to certain architectural design choices and proved difficult to be effectively mitigated without incurring significant performance penalties. In this work, we undertake a systematic mapping study of the academic literature related to the aforementioned attacks. We, in particular, pose four research questions and study 104 primary works to answer those questions. We inquire about the origins of artefacts leading up to exploitable settings of microarchitectural side-channel attacks; the effectiveness of the proposed countermeasures; and the lessons to be learned that would help build secure systems for the future. Furthermore, we propose a classification scheme that would also serve in the future for systematic mapping efforts in this scope.

This paper introduces an end-to-end processing method for multiple periodicity signal detection and analysis with particular application in software analysis using analog side channels. The probabilistic distributions of signal blocks are estimated with kernel density estimation. The corresponding kernel bandwidths, which are optimally found in a data-driven manner, are used to detect change points. After separating the signal into parts with different behaviors, average magnitude difference function is leveraged iteratively to find the smallest periodic signal sections. To illustrate efficiency of the proposed method, we use EM side-channel signals collected from real-life applications to successfully detect multiple existing periodicities.

Side-Channel Analysis (SCA) allows extracting secret keys manipulated by cryptographic primitives through leakages of their physical implementations. Supervised attacks, known to be optimal, can theoretically defeat any countermeasure, including masking, by learning the dependency between the leakage and the secret through the profiling phase. However, defeating masking is less trivial when it comes to unsupervised attacks. While classical strategies such as correlation power analysis or linear regression analysis have been extended to masked implementations, we show that these extensions only hold for Boolean and arithmetic schemes. Therefore, we propose a new unsupervised strategy, the Joint Moments Regression (JMR), able to defeat any masking schemes (multiplicative, affine, polynomial, inner product…), which are gaining popularity in real implementations. The main idea behind JMR is to directly regress the leakage model of the shares by fitting a system based on higher-order joint moments conditions. We show that this idea can be seen as part of a more general framework known as the Generalized Method of Moments (GMM). This offers mathematical foundations on which we rely to derive optimizations of JMR. Simulations results confirm the interest of JMR over state-of-the-art attacks, even in the case of Boolean and arithmetic masking. Eventually, we apply this strategy to real traces and provide, to the best of our knowledge, the first unsupervised attack on the protected AES implementation proposed by the ANSSI for SCA research, which embeds an affine masking and shuffling counter-measures.

Computer and network security is an ever important field of study as information processed by these systems is of ever increasing value. The state of research on direct attacks, such as exploiting memory safety or shell input errors is well established and a rich set of testing tools are available for these types of attacks. Machine-learning based intrusion detection systems are also available and are commonly deployed in production environments. What is missing, however, is the consideration of implicit information flows, or side-channels. Research has revealed side-channels formed by everything from CPU acoustic noise, to encrypted network traffic patterns, to computer monitor ambient light. Furthermore, no portable method exists for distributing side-channel test cases. This paper introduces a framework for adversary modeling and feedback generation on what the adversary may learn from the various side-channel information sources. The framework operates by monitoring two data streams; the first being the stream of side-channel cues, and the second being the stream of private system activity. These streams are used for training and evaluating a machine learning classifier to determine its performance of private system activity prediction. A prototype has been built to evaluate side-channel effects on four popular scenarios.

In this paper, we uncover a new off-path TCP hijacking attack that can be used to terminate victim TCP connections or inject forged data into victim TCP connections by manipulating the new mixed IPID assignment method, which is widely used in Linux kernel version 4.18 and beyond. Our attack has three steps. First, an off-path attacker can downgrade the IPID assignment for TCP packets from the more secure per-socket-based policy to the less secure hash-based policy, thus building a shared IPID counter that forms a side channel in the victim. Second, the attacker detects the presence of TCP connections by observing the side channel of the shared IPID counter. Third, the attacker infers sequence and acknowledgment numbers of the detected connection by observing the side channel. Consequently, the attacker can completely hijack the connection, e.g., resetting the connection or poisoning the data stream. We evaluate the impacts of our attack in the real world, and we uncover that more than 20% of Alexa top 100k websites are vulnerable to our attack. Our case studies of SSH DoS, manipulating web traffic, and poisoning BGP routing tables show its threat on a wide range of applications. Moreover, we demonstrate that our attack can be further extended to exploit IPv4/IPv6 dual-stack networks on increasing the hash collisions and enlarging vulnerable populations. Finally, we analyze the root cause and develop a new IPID assignment method to defeat this attack. We prototype our defense in Linux 4.18 and confirm its effectiveness in the real world. [ABSTRACT FROM AUTHOR]

In this brief, we proposed a highly-optimized FPGA-based implementation of the Ed448 digital signature algorithm. Despite significant progress in elliptic curve cryptography (ECC) implementations, Ed448 hardware architecture, to the best of our knowledge, has not been investigated in the literature. In this work, we demonstrate a high throughput while maintaining low resource architecture for Ed448 by employing a new combined algorithm for refined Karatsuba-based multiplier with precise scheduling. Furthermore, a compact distributed memory unit is developed to increase speed while keeping the area low. Our variable-base-point Ed448 architecture performs 327 signatures and 189 verifications per second at a notably higher security level of 224 bits, using not more than 6,617 Slices and 16 DSPs on a Xilinx Artix-7 FPGA. We also proposed possible countermeasures and extensions to Ed448 to counter the physical attacks. [ABSTRACT FROM AUTHOR]

We revisit a crucial privacy problem in this paper — can the sensitive information, like the numeric passwords and personal data, frequently typed by user on mobile devices be inferred through the motion sensors of wearable device on user's wrist, e.g., smart watch or wrist band? Existing works have achieved the initial success under certain context-aware conditions, such as 1) the horizontal keypad plane, 2) the known keyboard size, and/or 3) the last keystroke on a fixed “enter” button. Taking one step further, the key contribution of this paper is to fully demonstrate, more importantly alarm people, the further risks of typing privacy leakage in much more generalized context-free scenarios, which are related to most of us for the daily usage of mobile devices. We validate this feasibility by addressing a series of unsolved challenges and developing a prototype system aLeak. Extensive experiments show the efficacy of aLeak, which achieves promising successful rates in the attack from more than 500 rounds of different users’ typings on various mobile platforms without any context-related information. [ABSTRACT FROM AUTHOR]

Exploiting radio frequency signals with different physical characteristics of refraction and reflection of different parts and movements of the human body, most of the existing work focuses on the identification of single activity from a special part, and the elimination of mutual interference in different activities recognition of various parts of the body is deliberately diluted. A reliable, real-time, and non-invasive human body combination activities recognition system, namely, WiCoach, is proposed in this paper. WiCoach extends the possibility of utilizing the concept of sensorless sensing and the effective use of wireless signal side channels. Leveraging well-designed signal features and robust denoising methods, WiCoach models the speed and duration between channel state information and the body's multiple concurrent activities, and then recognizes activity of different parts and guides the individual fitness. The experimental results show that WiCoach can effectively discriminate the activities of different parts of the human body, and no longer relies on modeling the signal characteristics of single part, compared with the current work.

This paper presents the first hardware implementation of the datagram transport layer security (DTLS) protocol to enable end-to-end security for the Internet of Things (IoT). A key component of this design is a reconfigurable prime field elliptic curve cryptography (ECC) accelerator that is 238 $\times $ and 9 $\times $ more energy-efficient compared to software and state-of-the-art hardware, respectively. Our full hardware implementation of the DTLS 1.3 protocol provides 438 $\times $ improvement in energy-efficiency over software, along with code size and data memory usage as low as 8 and 3 KB, respectively. The cryptographic accelerators are coupled with an on-chip low-power RISC-V processor to benchmark applications beyond DTLS with up to two orders of magnitude energy savings. The test chip, fabricated in 65-nm CMOS, demonstrates hardware-accelerated DTLS sessions while consuming 44.08 $\mu \text{J}$ /handshake and 0.89 nJ/byte of the encrypted data at 16 MHz and 0.8 V. [ABSTRACT FROM AUTHOR]

This paper identifies two energy saving opportunities of Wi-Fi interface emerged during smartphone’s screen-off periods. Exploiting the opportunities, we propose a new power saving strategy, BackPSM, for screen-off Wi-Fi communications. BackPSM regulates client to send and receive packets in batches and coordinates multiple clients to communicate at different slots (i.e., beacon interval). The core problem in BackPSM is how to coordinate client without incurring extra traffic overheads. To handle the problem, we propose a novel paradigm, Out-of-Band Communication (OBC), for client-to-client direct communications. OBC exploits the Traffic Indication Map (TIM) field of Wi-Fi Beacon to create a free side-channel between clients. It is based upon the observation that a client may control $1 \rightarrow 0$ appearing on TIM bit by locally regulating packet receiving operations. We adopt this $1 \rightarrow 0$ as the basic signal, and leverage the time length in between two signals to encode information. We demonstrate that OBC can be used to convey coordination information with close to 100% accuracy. We have implemented and evaluated BackPSM on a testbed. The results show that BackPSM can decode the traffic pattern of peers reliably using OBC, and establish collision-free schedules fast to achieve out-of-band coordination of client communications. BackPSM reduces screen-off energy by up to 60% and outperforms the state-of-the-art strategies by 16%–42%. [ABSTRACT FROM AUTHOR]