Ben-Gurion seems to generate a lot of papers like this. Makes me wonder about the secret spy stuff that doesn't get published.
None of it makes for a practical attack.
Identifying attack vectors is just building up an arsenal of tools that can potentially be used depending on the circumstance.
Isn't this basically the exact thing that everyone thought before the Intel CPU bugs began emerging en-masse?
Notably, most of the attacks from Mordechai's lab describe low-bandwidth channels for deliberate data exfiltration. These attacks would only apply in unusual situations where an attacker can run arbitrary code on a machine, but the machine is isolated from the outside world. (Scenarios like Iranian nuclear facilities come to mind.)
And the range is VERY low for normal PC's that have had to pass EMC tests. For an all glass gamer RGB PC the things will be different.
Not with this - it’s a one way channel
So, in short, it only affects ineptly managed secure environments.
Yes.
> It's irrelevant to users who have intentionally enabled any kind of network communications on their computer
No, there are lots of use-cases at least for LAN communications.
> it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine).
No, it's relevant in those cases too, as part of a defense in depth strategy.
What I'm trying to get at here is that bizarre sidechannels like fan noise or SATA EMI are only relevant when the system administrator has thoroughly locked down all other possible channels of communication. If the system is connected to a wired network, it can communicate with other systems over that; if the network is connected to the Internet, even indirectly, there are probably ways to get data out through there. If the system has a WiFi card or Bluetooth adapter, that can be used to transmit data, even if there isn't an applicable network in range. Etc, etc.
For most people, if you are trying to exfiltrate some customer data to sell on the black market, are you going to spend a bunch of development time blinking a LED and setting up a receiver? Nah you’d just move to some other victim because you are trying to make a profit, not waste more money
But someone like a government trying to spy on another country… the cost of spies is pretty high… but pay some engineers to spend all day trying to make a LED blink some data is relatively cheap
That said, I think a lot of these attacks are kind of boring even if they were unpublished. If anyone here was paid 6 figures to do nothing all day but figure out some obscure variables in your computers to flip to exfiltrate some data, I’d be disappointed if you couldn’t figure anything out. I think most of these attacks are kind of obvious.
None of what gets released publicly makes for a practical attack.
No quicker way to get people to stop looking for your attack vector than to convince them it doesn't work.
Now if you'll excuse me, I need to go and re-wrap my head in tin foil.