News for hackers. Stuff that matters.
Re:Air-Gapped Computers Can Be Compromised Using EM Side-Cha... by schoen on Friday January 30, 2015 @03:04PM (#8974115)
I found this summary of the paper disappointing. The paper that this is reporting on is at

http://users.ece.gatech.edu/~az30/Downloads/Micro14.pdf

and describes a framework for measuring how bad side channel risks are (using custom software that tries to create a worst-case scenario by intentionally signaling to the outside world). They then turn out to be pretty bad, in the intentional case, but a big part of the researchers' contribution is that perhaps this is quantifiable, for each particular kind of side channel that one wants to examine.

This paper did not introduce any new kind of side channel, and extensively cites literature in which other people introduced (and often demonstrated) the side channel and emanations risks. These risks are often very bad, governments have studied them intensively since at least the 1960s, and it's a great thing that academic researchers are now helping make the public familiar with them. Hopefully that will lead to some techniques for mitigating them in practice other than living and working in a SCIF.

Indeed, for timing-channel attacks there are lots of important mitigations that software developers are now learning about (having to do with performing operations in constant-time). Maybe this research can point to ways of making some operations (approximately) constant-power, so power and RF-related information leakages will be attenuated.

Re:Air-Gapped Computers Can Be Compromised Using EM Side-Cha... by tptacek on Friday January 30, 2015 @03:06PM (#8974130)
Power side channels are extensively studied. See, for instance, most smart card research.
Re:Air-Gapped Computers Can Be Compromised Using EM Side-Cha... by schoen on Friday January 30, 2015 @03:10PM (#8974156)
You're right. Maybe I should just say that this research provides a possible way to measure how effective mitigations have been, if we believe that their metric is meaningful.