Word of the Day: side-channel attack

Word of the Day Daily updates on the latest technology terms | April 12, 2019 side-channel attack A side-channel attack (SCA) is a security exploit that involves collecting information about what a computing device does when it is performing cryptographic operations and using that information to reverse engineer the device's cryptography system. In computing, a side channel is any communication channel that is incidental to another communication channel. Security researcher Paul Kocher is credited with coining the term side-channel attack in the 1990s when he discovered it was possible to reverse engineer security tokens by monitoring a computer's power consumption and electromagnetic emissions. Unlike many other types of security exploits, side-channel attacks are hardware and software agnostic. Instead of targeting a software vulnerability caused by a coding error or configuration drift, the attacker exploits the way the device's operating system (OS) accesses the hardware upon which the OS runs. Side-channel attacks can be launched against any operating system, including Windows and Linux. Types of Side-Channel Attacks Side-channel attacks work by monitoring the emissions produced by electronic circuits when the victim's computer is being used. In addition to exploiting information about power consumption and electromagnetic fields, an attacker may actually listen to the sounds a central processing unit (CPU) produces and use that information to reverse engineer what the computer is doing. This type of side-channel attack is called an acoustic cryptanalysis attack. Other types of side-channel attack include: Cache attacks that exploit how and when cache is accessed in a physical system.   Differential fault analysis attacks that seek to glean information from a system by introducing faults into the system's computations.   Timing attacks that track the movement of data to and from a system's CPU and memory.   Thermal-imaging attacks that use infrared images to observe the surface of a CPU chip and collect executed code.   Optical side-channel attacks that collect information about hard disk activity by using an audio/visual recorder, such as a video camera.   Van Eck phreaking is a form of eavesdropping that involves monitoring the electromagnetic fields produced by data as it moves through the computer. How to Prevent Side-Channel Attacks To prevent side-channel attacks, users have two choices: they must either reduce the release of electromagnetic information that could be used to launch an attack or they must make it impossible for an attacker to link information about what the CPU is doing with specific compute operations. For example, a computer engineer may want to change the order of operations used on data within the system by using a process called randomization to make it more difficult for an attacker to launch a side-channel attack. Another preventative technique an engineer may use is to increase the amount of noise in a channel. An increase in noise means an attacker will have to collect more measurements than is needed and not all the information will be relevant. Faraday cages can also be used to reduce electromagnetic leaks. Quote of the Day "Patches are issued for side channel attacks like Spectre and Meltdown, but the patches are fixing little holes and not the problem -- an attacker could come up with a variation of Spectre or Meltdown that avoids the patch and causes significant trouble." - Raluca Ada Popa Trending Terms cryptography reverse engineering van Eck phreaking Faraday cage configuration drift Learning Center NetSpectre is a remote side-channel attack, but a slow one NetSpectre is the first remote exploit against Spectre variant 1, but one expert questioned if the speed at which the exploit works could hinder its real-world impact. PortSmash side-channel attack targets Intel Hyper-Threading A new Intel side-channel attack -- PortSmash -- targets the simultaneous multithreading architecture of the CPU to steal private data and experts said a realistic exploit may not be difficult. The future of data security threats and protection in the enterprise Planning for the future of data security can lead execs to panicked preparation for a catastrophic cybersecurity event. Instead, expert Raluca Ada Popa advises incremental improvements of existing security. Add two-factor authentication, end-to-end encryption and cryptographic identification. TLBleed attack can extract signing keys, but exploit is difficult Researchers discovered a side-channel attack, named TLBleed, that abuses the Hyper-Threading feature of Intel chips. But Intel said customers should be immune, even without a patch. The implications of the NetSpectre vulnerability The NetSpectre vulnerability could enable attackers to gather leaking data remotely via side channels. Though it can only extract about 15 bits per hour, this exploit proves that even on secure networks, data is not safe. Quiz Yourself To prevent a crippling worm attack, the Department of Homeland Security (DHS) urged that all users _______ application of the patch. a. expedite b. expediate Answer Stay in Touch For feedback about any of our definitions or to suggest a new definition, please contact me at: mrouse@techtarget.com Visit the Word of the Day Archives and catch up on what you've missed! FOLLOW US About This E-Newsletter This e-newsletter is published by the TechTarget network. To unsubscribe from Whatis.com, click here. Please note, this will not affect any other subscriptions you have signed up for. TechTarget, Whatis, 275 Grove Street, Newton, MA 02466. Contact: webmaster@techtarget.com Copyright 2018 TechTarget. All rights reserved.