Academics Discover Method to Retrieve Cryptographic Keys by Analyzing Fluctuations in LED Brightness

A group of academic researchers hailing from the Ben-Gurion University of the Negev and Cornell University have devised an extraordinarily cunning side-channel attack method capable of retrieving secret keys from a device. The crux of their technique lies in analyzing video footage of the power LED to extract cryptographic keys. The researchers made a fascinating observation: the power consumption of the device, generated by the CPU's cryptographic computations, directly impacts the brightness of the power LED. This key insight sparked the realization that malicious actors could exploit ubiquitous video camera devices, including popular models like the iPhone 13 and internet-connected surveillance cameras, to pilfer cryptographic keys from smart card readers.

The attack strategy cleverly capitalizes on the rolling shutter effect of the camera, allowing it to record the LED's rapid changes in brightness, which correspond to physical emanations. Unlike the power line of the electrical circuit, the LED lacks effective decoupling mechanisms such as filters or voltage stabilizers, rendering it susceptible to correlations with power consumption.

In an illuminating simulated test, the researchers achieved a remarkable feat by successfully recovering a 256-bit ECDSA key from a smart card. This impressive outcome was achieved through meticulous analysis of video footage capturing the LED's flickering, employing an internet-connected security camera that had been compromised. Furthermore, they pushed the boundaries even further by demonstrating the extraction of a 378-bit SIKE key from a Samsung Galaxy S8 handset. This time, they trained an iPhone 13 camera on the power LED of Logitech Z120 speakers connected to a USB hub responsible for charging the phone.

These findings underscore the critical importance of considering potential side-channel attacks that ingeniously exploit seemingly innocuous components, such as power LEDs. As our world becomes increasingly interconnected, it becomes ever more crucial to implement robust countermeasures that can effectively shield against such attacks. Furthermore, it highlights the need for ongoing vigilance and awareness of emerging security risks in order to maintain the integrity of sensitive cryptographic systems.