In what’s an ingenious side-channel attack, a group of academics has found that it’s possible to recover secret keys from a device by analyzing video footage of its power LED.
“Cryptographic computations performed by the CPU change the power consumption of the device which affects the brightness of the device’s power LED,” researchers from the Ben-Gurion University of the Negev and Cornell University said in a study.
By taking advantage of this observation, it’s possible for threat actors to leverage video camera devices such as an iPhone 13 or an internet-connected surveillance camera to extract the cryptographic keys from a smart card reader.
Specifically, video-based cryptanalysis is accomplished by obtaining video footage of rapid changes in an LED’s brightness and exploiting the video camera’s rolling shutter effect to capture the physical emanations.
“This is caused by the fact that the power LED is connected directly to the power line of the electrical circuit which lacks effective means (e.g., filters, voltage stabilizers) of decoupling the correlation with the power consumption,” the researchers said.
In a simulated test, it was found that the method allowed for the recovery of a 256-bit ECDSA key from a smart card by analyzing video footage of the power LED flickers via a hijacked Internet-connected security camera.
A second experiment allowed for the extraction of a 378-bit SIKE key from a Samsung Galaxy S8 handset by training the camera of an iPhone 13 on the power LED of Logitech Z120 speakers connected to a USB hub that’s also used to charge the phone.
What makes the attack notable is that the modus operandi is non-intrusive, either banking on physical proximity or over the internet, to steal the cryptographic keys.
That said, there are a few limitations to reliably pull off the scheme. It requires the camera to be placed 16 meters away from the smart card reader and in a manner such that it has a direct line of sight view of the power LED. Then there’s the condition that the signatures are recorded for a duration of 65 minutes.
It also presupposes that there exists a side-channel based on power consumption that leaks sensitive information which could be used for cryptanalysis, making such attacks an exception rather than a norm.
To counter such attacks, it’s recommended that LED manufacturers integrate a capacitor to reduce fluctuations in power consumption or, alternatively, by covering the power LED with black tape to prevent leakage.
Ben Nassi, the lead researcher behind the attack technique, has previously devised similar approaches in the past – Lamphone and Glowworm – that employ overhead hanging bulbs and a device’s power indicator LED to eavesdrop on conversations.
Then last year, the researchers demonstrated what’s called the “little seal bug” attack that utilizes an optical side-channel associated with lightweight reflective objects to recover the content of a conversation.
