Air-Gapped Computers Can Be Compromised Using EM Side-Channel Attacks
tripwire.com
tripwire.com
http://users.ece.gatech.edu/~az30/Downloads/Micro14.pdf
and describes a framework for measuring how bad side channel risks are (using custom software that tries to create a worst-case scenario by intentionally signaling to the outside world). They then turn out to be pretty bad, in the intentional case, but a big part of the researchers' contribution is that perhaps this is quantifiable, for each particular kind of side channel that one wants to examine.
This paper did not introduce any new kind of side channel, and extensively cites literature in which other people introduced (and often demonstrated) the side channel and emanations risks. These risks are often very bad, governments have studied them intensively since at least the 1960s, and it's a great thing that academic researchers are now helping make the public familiar with them. Hopefully that will lead to some techniques for mitigating them in practice other than living and working in a SCIF.
Indeed, for timing-channel attacks there are lots of important mitigations that software developers are now learning about (having to do with performing operations in constant-time). Maybe this research can point to ways of making some operations (approximately) constant-power, so power and RF-related information leakages will be attenuated.
One interesting extension beyond the classical 1960s TEMPEST/Van Eck stuff is: If you can run malware on the target computer, you can obviously increase the effective gain through a variety of techniques.
What I'd be super interested in would be active RF attacks -- similar to the NSA toolkit with the passive external-RF-powered transmitter for implants, but ideally without modifications. Either causing specific errors or something else. Forcing resets might be enough. It'd be sort of a crossover between EMP and TEMPEST. Knowing, for instance, that the target security system controller is the only device connected to an 18.2m long wire within a facility might make it profitable to do a targeted attack on a certain frequency.
It would be very important to know if a digital equivalent is possible.
[1] http://en.wikipedia.org/wiki/Sensitive_Compartmented_Informa...
There have been several papers published about keyboard acoustic sidechannels as well.
The US military tests their gear for this. Their test facility: (http://www.epg.army.mil/e3tf.aspx) has RF anechoic chambers big enough for a tank. They're interested in both "can it be eavesdropped upon" and "can it be interfered with".
Modern electronics is much RF-quieter than older stuff. This is because so much of it has radios inside. If your device generates much RF hash, the WiFi, Bluetooth, and cellular radios will all have much-reduced range. In the early days of personal computing, some devices were very noisy. A Radio Shack TRS-80 and a Milton Bradly Big Trak toy would both crash if operated near each other. We're way beyond that now.
The FCC's requirements on RF noise from electronics helped a lot. There was much grumbling at the time from hobbyists about RFI compliance requirements interfering with their freedom to tinker. The FCC was right, though. Today, almost no consumer electronics interferes with other consumer electronics. You can use a cell phone inside a data center and receive clear calls. Cell phones themselves have several radios, all going at once.
This is a remarkable achievement in RF compatibility. For a sense of how bad it once was, see the Marine Radio Society, (http://www.radiomarine.org/), which has restored an abandoned ship-to-shore radio station in Marin County, CA. All the receivers are in one building. The transmitters are in another building, several miles away, to keep them from interfering with the receivers.
You just reminded me of something, back in the 80's I had a ZX Spectrum (I'm in the UK) which the TRS-80 was similar to.
The HAM operator down the road eventually figured out it was me with the computer, when I was using it, the RF bled across everything.
The same can be said for keyboards and mice as well, especially wireless ones. The solution is a faraday cage.
RF attacks on serial connections (which includes not just serial ports but USB and Ethernet) are much easier. All the bits you want are right there. Historically, Teletypes generated RF which was easy to monitor, and the Friden Flexowriter could be monitored from half a mile away.
Self-synchronous logic does not have global clock and operations have different timings.
As an example, in a synchronous logic one has to use carry-ahead variant of adder to get worst case time to O(logN). In a self-synchronous logic regular ripple-carry adder will suffice and produce result in O(logN) time in average case (yes, O(N) in worst case, which will met with probability p=1/2^N). Even more, adding small integers of K bits will result in O(logK) operations.
This means that each operation will have different completion time in self-synchronous logic. This is due to variance in inputs and/or temperature variance.
This, in turn, means that radio emission from operation completion in self-synchronous CPU will be much more smooth than for regular CPU.
"The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away."
http://www.tau.ac.il/~tromer/acoustic/
Video: http://youtu.be/DU-HruI7Q30
I'm pretty sure there's a better video of the attack being performed somewhere, but I can't find it right now.
http://eckbox.sourceforge.net/
EDIT: Should have just linked to the paper instead. It looks like their primary contribution was an ability to measure the susceptibility of a device to these kinds of attacks.