I read that a group of cryptology experts extracted a 4,096-bit RSA key from a laptop using a sound-based attack...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
technique. Can you explain how a sound-based attack works, whether it is an enterprise threat, and what we can do to mitigate the risks?
It should be no surprise that even an enterprise inside a Faraday cage, buried in a vault with 10-foot concrete walls can be successfully attacked. While it seems far-fetched, enterprises with high security requirements may want to plan for attacks that use sound-based attack techniques. These organizations might also want to add another 10 feet of concrete and destroy any microphones, telephones or other devices with audio features to stop sound attacks. They may also want to generate their own power to prevent analysis of their power consumption.
Yes, I'm being facetious, but the truth is, this is among the latest high-concept attach techniques that certain organizations with government-level security requirements should at least be aware of. For all other enterprises, this proof-of-concept exploit is not something you need to address.
I'm not diminishing the research performed by Adi Shamir, one of the inventors of the RSA algorithm, or Daniel Genkin and Eran Tromer of Tel Aviv University. They were able to identify a weakness in an encrypted GnuPG email plug-in, Enigmail, where it was configured to decrypted email by default. They found that when a certain mathematical operation was performed, the computer would emit a detectable, high-pitched noise. The trio could then monitor for this noise using a cell phone or a high-quality microphone at up to roughly 13 feet away. This allowed them to extract a 4,096-bit RSA decryption key from a targeted laptop.
GnuPG has since patched the vulnerability, so enterprises should install the new version of the software. This particular attack technique also requires automated decryption to be enabled -- which is known to be higher risk -- so disabling automated decryption could also reduce the threat.
Ask the Expert!
Have a question about enterprise threats? Send it via email today! (All questions are anonymous.)
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
A keylogging flaw found its way into dozens of Hewlett Packard laptops. Nick Lewis explains how the HP keylogger works and what can be done about it.continue reading
Can Structured Threat Information eXpression improve threat intelligence sharing? Nick Lewis breaks down the evolution of the STIX security framework.continue reading
A new type of WordPress malware, WP-Base-SEO, disguises itself as an SEO plug-in that opens backdoors. Nick Lewis explains how it works and how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.