Analyze the electromagnetic emissions of smartphones in search of security holes

Researchers from the Carlos III University of Madrid (UC3M) and the Higher Council of Scientific Research (CSIC) (Spain) are developing a tool that allows analyzing whether mobile phones can suffer cyber attacks to obtain encryption keys through their broadcasts Electromagnetic

This platform, whose objective is to improve the security of mobile phones and other electronic devices that use encryption techniques, has recently been presented in Canada at an international congress focused on the security and privacy of the Internet of Things (Workshop on Security and Privacy on the Internet of Things).

This research focuses on the so-called “side-channel attacks”, which occur when “you try to take advantage of a circumstance (in this case, that an electric current produces a magnetic field) for an illicit benefit (in this case, the attacker tries to extract the private encryption key, which in theory should not have access), “explains one of the researchers, José María de Fuentes, of Computer Security Lab (COSEC) of UC3M.

Traditionally, an attempt was made to attack the encryption algorithm, that is, the procedure to protect information, which usually has a complex mathematical basis. Subsequently, this type of lateral channel attacks has been developed to look for other ways to violate security without having to “break” the mathematics that sustains it. “When the devices are in operation, they use the energy and generate electromagnetic fields. We try to capture their traces to obtain the encryption key and, in turn, the decryption of the data, “explains another of the researchers, Lorena González, also from the COSEC group at UC3M.

“We want to show if these types of devices have vulnerabilities, because if they are attacked by an adversary, that is, if someone calculates the key you are using on your mobile phone, you will be vulnerable and your data will no longer be private,” says another of the researchers, Luis Hernández Encinas, of the Institute of Physical Technologies and Information (ITEFI) of the CSIC.

The main objective of this research is to detect and disclose the vulnerabilities of electronic devices or the chips they contain so that both software and hardware developers can implement appropriate countermeasures to protect the safety of users. “Our next task will be to verify if this has been carried out correctly and to try to attack again to check if there are other types of vulnerabilities,” adds Luis Hernández Encinas.

[wp_ad_camp_3]

The most relevant aspect of this project, according to the researchers, is that they are developing an architecture and a work environment where they can continue exploring this type of lateral channel attacks. In fact, there is the possibility of extracting encryption information from other data, such as temperature variations of the device, power consumption or the time it takes for a chip to process a calculation.

This research has been carried out within the framework of CYBERDYNE (Cybersecurity: Data, Information, Risks), an R & D & I program funded by the Ministry of Education, Culture, and Sport of the Community of Madrid and by Structural Funds of the Union European Its main objective is to develop technological tools that allow cyberspace to be a safer and more reliable environment for public administrations, citizens, and businesses. To do this, we work on three main lines of research: the massive analysis of data networks, cooperative cybersecurity and decision support systems in this area. (Source: UC3M / DICYT)