Fotolia
How do I stop the screaming channel wireless threat?
A screaming channel attack is a new wireless threat making networks -- particularly those with IoT components -- vulnerable. Are there any safeguards to prevent these attacks?
Security researchers at EURECOM S3 Group published a paper on communications chips that are vulnerable to what they call "screaming channel" attacks. What are screaming channel attacks, and what mitigations are available for this wireless threat?
Hardware security received significant attention in 2018, and side channels have been an avenue to attack even the most secure systems since before the Orange Book -- the Department of Defense standard criteria for trusted computer system evaluation -- was published in 1983. The book included a chapter about covert channels, which are intentionally designed to be hidden communications channels for conveying data.
Side channels are communications channels incidental to ordinary channels, but they can be exploited in a wireless threat to carry data by an attacker. Many of these attacks require the placement of controlling software on a target system. In addition, the system used to control the software must be in close physical proximity to the target. This allows a hacker to launch an attack, for example, by issuing commands over a wireless network channel.
This type of wireless threat can be thwarted by using strong physical security to prevent an attacker from getting within radio range of the targeted device. One method for blocking radio transmission leaks is a faraday cage.
Pumping up the volume for a new attack
Researchers from EURECOM recently published results of a study that revealed a new tactic designed to overcome that safeguard -- dubbed a screaming channel attack. A screaming channel occurs when logic chips are implemented on the same integrated circuits as a system's wireless capabilities. This results in side-channel radiation being amplified and accessible to an attacker from a greater distance than would ordinarily be possible.
The attack requires the Wi-Fi or Bluetooth chip to share logic circuitry used for encryption. Placing encryption circuitry on one chip may be done to offload the cryptoprocessing from the rest of the system. This can improve performance, an important benefit for IoT networks. When the encryption takes place on the chip, electromagnetic signals can leak. Those signals are then picked up by the radio antenna for the Wi-Fi or Bluetooth chip and then broadcast for an attacker to capture.
The wireless threat also requires tinyAES be used in software, rather than full AES 128, and that encryption is not offloaded to a separate system. After collecting enough leakage, the encryption key on the target system can be discovered.
In their investigation, EURECOM researchers attacked a target system in a noncontrolled environment. Attackers would also have to be able to identify the types of chipsets used on the target systems. That information, however, can be gleaned by the external labeling from the manufacturer of the target.
Minimal immediate mitigations are available to combat this threat, including the following:
- rapid rekeying to use new encryption keys;
- disabling the Wi-Fi or Bluetooth chip when generating encryption keys; or
- using dedicated cryptohardware in the CPU or trusted platform module, rather than the on-chip circuitry.
Longer-term mitigations include better chip design to reduce electromagnetic leakage or beefed-up physical shielding around sensitive circuitry.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
