6

I know that electromagnetic emissions from a device can be used to extract information from a system, e.g. TEMPEST or Van Eck phreaking.

I also know it's possible to induce a signal into a communications channel using electromagnetic induction, e.g. a telephone wire. Has the concept been proven for communications channels such as ethernet and USB? Are there any papers on this?

Polynomial
  • 132,208
  • 43
  • 298
  • 379

2 Answers2

3

I don't know of any attacks on Ethernet or USB, but here are two related topics that might interest you.

Fault attacks. A fault attack involves injecting some sort of error or faulty data into a computation. It is sort of the dual of a side-channel attack. Some research papers you might enjoy:

See also Ross Anderson's Security Engineering, particularly the chapters on Emission Security and Physical Tamper Resistance.

Active side-channel attacks. You might be interested in learning about NONSTOP and HIJACK. These are military codewords that are not fully understood, but there is some running speculation that they relate to side-channels that arise when equipment carrying sensitive data is irradiated by a high-strength signal.

D.W.
  • 98,420
  • 30
  • 267
  • 572
1

I'm not aware of such attacks. It may be significantly harder than attacking telephone wires due to the high frequencies used in todays USB/Ethernet.

I also imagine it would be of questionable merit. If you want to inject data, you can use Wifi, physically tap into cables or attach to Thunderbolt/Firewire ports and perform DMA transfers. Don't see much point in attaching some specialized induction device.

The more mainstream works on extracting information have considered smart power meters. They've been used to infer what devices you're using and even what TV channel you're watching. See last ACM CCS conferences.

pepe
  • 3,536
  • 14
  • 14
  • 1
    Physically tapping into cables may not be possible. Imagine, for example, a company with strong physical security, but with exposed ethernet wires on the external of their building. If the attacker can't (quite) reach the cables, due to a fence or similar barrier, would it be feasible to target significant electromagnetic energy at the cable in order to at least disrupt a stream, if not inject data semi-reliably? – Polynomial Jul 24 '12 at 15:22
  • I'm not an electrical engineer, but the required frequencies probably require quite a bulky device to be installed on the outside. Disruption should be easier though. And if they don't run crypto on the wire, which is a prerequisite for injection, then I would be more concerned about info leakage. – pepe Jul 24 '12 at 22:21