PaperlayerView exact revision on arXiv

Source-linked AI summary

Systematic Classification of Side-Channel Attacks: A Case Study for Mobile Devices

Raphael Spreitzer, Veelasha Moonsamy, Thomas Korak, Stefan Mangard

arXiv:1611.03748v3cs.CR

TL;DR

Mobile side-channel attacks increasingly operate through applications and exploit the extensive sensitive information and capabilities of smartphones. The paper surveys existing attacks, proposes a new categorization system, and identifies commonalities, attack trends, open issues, and research directions. Its classification organizes the evolving attack landscape and is intended to support systematic analysis and further countermeasure research.

  • Problem

    A systematic survey and classification covering all categories of mobile-device side-channel attacks is lacking despite the security and privacy risks of smartphone attacks.

  • Method

    The paper surveys existing mobile side-channel attacks, identifies commonalities, and establishes a new categorization system for modern attacks.

  • Results

    The classification summarizes attack categories and targeted information while showing a shift toward remote smartphone attacks involving hardware properties and software features.

  • Takeaways & Limitations

    The classification provides a systematic framework for understanding information leaks and is intended to spur research on side-channel attacks and countermeasures.

Abstract

from arXiv · show

Side-channel attacks on mobile devices have gained increasing attention since their introduction in 2007. While traditional side-channel attacks, such as power analysis attacks and electromagnetic analysis attacks, required physical presence of the attacker as well as expensive equipment, an (unprivileged) application is all it takes to exploit the leaking information on modern mobile devices. Given the vast amount of sensitive information that are stored on smartphones, the ramifications of side-channel attacks affect both the security and privacy of users and their devices. In this paper, we propose a new categorization system for side-channel attacks, which is necessary as side-channel attacks have evolved significantly since their scientific investigations during the smart card era in the 1990s. Our proposed classification system allows to analyze side-channel attacks systematically, and facilitates the development of novel countermeasures. Besides this new categorization system, the extensive survey of existing attacks and attack strategies provides valuable insights into the evolving field of side-channel attacks, especially when focusing on mobile devices. We conclude by discussing open issues and challenges in this context and outline possible future research directions.

I. INTRODUCTION

Side-channel attacks have evolved from physically observed attacks on smart cards to remote and software-assisted attacks on mobile devices. The paper responds by proposing a categorization system grounded in a survey of existing attacks.

  • Traditional side-channel attacks required physical device access and often targeted cryptographic implementations through timing, power, or electromagnetic leakage.
  • Cloud-era attacks expanded the scope to remote attacks using malicious software, including cache-timing and DRAM row-buffer attacks.
  • Smartphone attacks are enabled by always-on portability, BYOD use, easy software installation, Linux-based operating systems, and diverse features and sensors.
  • The paper establishes a new categorization system for mobile side-channel attacks by surveying existing attacks and identifying commonalities.
  • Smartphone side channels exploit both physical properties, such as accelerometer readings, and software properties exposed by Android or the mobile OS.
  • Figure 1 categorizes attacks by the information exploited and how the adversary learns it, while relating smart-card, cloud, and smartphone attacks to the framework.

B. Outline

The paper introduces smartphone-security foundations and defines side-channel attacks as inference from unintended or otherwise available leakage rather than direct exploitation of software vulnerabilities. It distinguishes passive observation from active manipulation.

  • The paper establishes boundaries between side-channel attacks and attacks that directly exploit OS or application vulnerabilities.
  • Mobile-device security relies on application sandboxing, permission systems, cryptographic mechanisms, and protections such as PINs.
  • A passive side-channel attack consists of a target, a physical or logical side channel, and an attacker who observes leakage to infer useful information.
  • An active side-channel attacker influences a device through a side channel to bypass security mechanisms or cause malfunctioning and subsequent leakage or erroneous output.
  • The smartphone example treats touchscreen input as the target and accelerometer readings accessed through the Sensor API as the side channel.
  • The paper excludes covert channels from its survey, although the proposed classification system can also classify them.

C. Related Surveys

Existing surveys cover mobile security, malware, smart cards, timing channels, cloud microarchitectural attacks, and covert channels, but mobile side-channel coverage remains fragmented. The paper therefore presents a systematic classification-oriented survey.

  • Mobile-security surveys primarily emphasize malware, permissions, code analysis, malware identification, and related defenses rather than side-channel attacks.
  • Prior side-channel surveys address smart-card cryptography, network and system timing channels, cloud microarchitectural attacks, and cloud covert channels.
  • Existing smartphone surveys examine broad Android security topics or specific sensor-based keylogging attacks.
  • A systematic survey and classification of all existing categories of mobile-device side-channel attacks was not available in the surveyed literature.
  • The paper’s approach is to discuss information leaks, software-only attacks, adversary models, and a new categorization system.

A. Types of Information Leaks

Mobile side-channel attacks exploit either unintended leaks from device behavior or information deliberately exposed by smartphone features. Software-only attacks can observe both physical and logical properties without dedicated equipment, including information shared through operating-system interfaces.

  • Leak types: Mobile side-channel information leaks comprise unintended leaks and information published on purpose.Unintended leaks include execution time, power consumption, and electromagnetic emanation; deliberate disclosures arise from smartphone features and interfaces.
  • Information published on purpose: Seemingly harmless disclosures such as memory footprints and data-usage statistics can reveal sensitive user information.The paper gives visited websites as an example of information inferred from these disclosures.
  • Leak types: Information deliberately exposed by expanding smartphone features may be especially dangerous because new interfaces can expose unprotected resources.The paper contrasts this with defenses against unintended leaks, such as constant-time cryptographic implementations.
  • Software-only attacks: Software-only attacks exploit physical or logical properties without the additional equipment required by traditional attacks.Examples include execution time and power consumption as physical properties, and memory footprint and data-usage statistics as logical properties.
  • Software-only attacks: Software-only side-channel attacks are a subset of runtime-information gathering attacks, which may also directly steal sensitive information through permissions or implementation flaws.The paper excludes direct-access cases such as unauthorized screenshot capture from its side-channel definition.

C. Adversary Model and Attack Scenario

Modern smartphone side-channel attacks commonly shift from physical possession toward remote software execution through apps or websites. The paper organizes attacks by adversary location and activity, then surveys their attack workflow and representative local techniques.

  • Adversary model: Most existing smartphone side-channel attacks can be launched remotely through apps or websites, potentially scaling from a few devices to millions of users.A seemingly harmless app distributed through an app market can provide a practical delivery mechanism.
  • Attack scenario: During training, attackers profile events and build templates, sometimes using a supervised machine-learning classifier.The profiling may occur online on the target device or offline in a dedicated environment.
  • Attack scenario: During the attack, a hidden malicious application waits for a target event, observes leakage, and applies the learned model to infer secrets.The application may be distributed through existing app markets and operate in the background.
  • Adversary model: The proposed classification uses passive versus active behavior, physical versus logical properties, and local, vicinity, versus remote attackers.Passive attackers observe leakage, whereas active attackers influence the target, its input, or its environment.
  • Survey organization: The survey proceeds by attacker location, covering local, vicinity, and remote attacks, with passive and active subdivisions.The subsection structure reflects the classification system but does not separately organize attacks by physical and logical properties.
  • Local attacks: Local attacks include cryptographic attacks, user-interaction attacks, and touchscreen-input attacks arising from mobile-device characteristics.The survey includes traditional attacks against cryptographic implementations as well as attacks targeting user input.

B. Active Attacks

Active side-channel attacks manipulate a device, its input, or its environment and then analyze abnormal or erroneous behavior. Mobile-device examples include glitching, electromagnetic and optical fault injection, temperature attacks, and attacks on controlled software execution.

  • Active attack model: Active attackers manipulate the target, input, or environment before observing abnormal behavior or bypassing security mechanisms.Unlike passive attacks, active attacks assume the attacker possesses the device at least temporarily.
  • Fault analysis: Fault attacks recover secrets by introducing faults and comparing erroneous outputs with normal outputs.This strategy appears in differential fault attacks and white-box fault-injection attacks that manipulate data or control flow.
  • Clock/Power Glitching: Voltage glitching can disturb ARM program execution and poses a serious smartphone threat when attackers have physical access.The cited Raspberry Pi example underpowers the processor by briefly setting supply voltage to ground; similar attacks were demonstrated on Android smartphones.
  • Electromagnetic Fault Injection: EMFI uses short, high-energy electromagnetic pulses to alter localized chip regions, unlike typically global voltage glitches.Reported effects include memory-cell changes, instruction skips, and instruction replacements on ARM processors.
  • Laser/Optical Faults: Optical fault injection can induce transistor state changes and memory bit flips but requires costly chip decapsulation and high effort.The paper describes focused laser beams as effective while noting increasing metal layers and smaller feature sizes complicate access.
  • Temperature Variation: Temperature variation causes faults by heating memory or changes RAM remanence after power-off by cooling the device.The paper links cooling to the persistence time of RAM contents after shutdown.
  • Temperature Variation: Cold-boot attacks exploit increased RAM data persistence at low temperature, while heating faults target faulty computation.FROST recovers disk-encryption keys from RAM on Android devices; heating attacks were demonstrated against RSA on an AVR microcontroller.

C. Overview

The overview maps attack categories to the information they target and identifies both demonstrated coverage and gaps for future investigation. Targets include cryptography, application execution, application inference, and user input.

  • Overview: Table II relates local side-channel attack categories to cryptographic implementations, program flow, application inference, and user input.The table marks whether each attack has been performed against each target and highlights possible research gaps.
  • Overview: Some attack-target combinations remain unexplored, including possible power-analysis attacks on user input and smudge attacks on cryptographic algorithms.The paper states that smudge attacks against cryptographic algorithms are unlikely to work, while other combinations may merit investigation.

V. VICINITY SIDE-CHANNEL ATTACKS

Vicinity side-channel attacks exploit information observable near the targeted user or device, including network metadata, charging power traces, and Wi-Fi signal changes. Active attackers can additionally influence transmitted packets to improve inference.

  • Vicinity attacks require the attacker to compromise infrastructure within the targeted user’s environment.
  • Network Traffic Analysis: Encrypted communications still expose metadata such as data volume, packet lengths, and inter-packet timings, enabling inference of sensitive content or visited websites.
  • USB Power Analysis: Modified public USB charging stations can collect power traces that reveal sensitive information about users and mobile devices.
  • USB Power Analysis: Power traces from charging infrastructure can identify users or devices and infer visited websites despite USB adapters blocking data pins.
  • Wi-Fi Signal Monitoring: Wi-Fi channel-state changes caused by finger motions and keystrokes can reveal keyboard inputs or smartphone unlock patterns.
  • Active Attacks: Active vicinity attackers can delay transmitted packets, allowing improved website fingerprinting by reducing overlap among responses.

C. Overview

The surveyed software-only attacks exploit information exposed by operating-system interfaces, application statistics, microarchitectural behavior, sensors, and memory-management mechanisms. They infer browsing behavior, application actions, identities, and user input without requiring physical proximity.

  • Overview: The survey identifies visited websites, application or action information, users and devices, and user input as principal targets.
  • Overview: The surveyed attacks are software-only and can run remotely when a victim installs a malicious application, enabling larger-scale targeting.
  • Logical Properties: Procfs exposes memory footprints, CPU times, context switches, and interrupt counters that attackers use to infer browsing behavior, application transitions, and swipe input.
  • Data-Usage Statistics: Per-application data-usage statistics are accessible without permission and reveal disease conditions, financial portfolios, user identities, and browsing behavior.
  • Page Deduplication: Copy-on-write timing differences support application and file-download detection and can fingerprint visited websites from JavaScript.
  • Microarchitectural Attacks: Cache-timing attacks on Android devices reduce the effective AES key size, while JavaScript-based attacks can track mouse movements and browsed websites.
  • Sensor-based Keyloggers: Motion and ambient-light sensors have been used to infer touchscreen digits, characters, PINs, patterns, and other user input, including through websites.

B. Active Attacks

Active software-only side-channel attacks can induce hardware faults rather than merely observe leakage. Rowhammer is the prominent example, using repeated memory accesses to cause bit flips in neighboring DRAM cells.

  • Active Attacks: Active side-channel attacks executed solely through software are receiving increasing research attention.
  • Rowhammer: Rowhammer exploits DRAM disturbance errors to conduct software-induced fault attacks.
  • Rowhammer: Frequent memory accesses can induce bit flips in neighboring victim memory cells through electromagnetic coupling effects in dense DRAM.

C. Overview

The classification system organizes attacks by activity, exploited properties, and attacker location, revealing trends toward remote, software-enabled attacks and mixed physical-logical techniques. It also exposes undercovered categories for future research.

  • C. Overview: Figure 7 classifies attacks by active versus passive behavior, logical versus physical properties, and local, vicinity, versus remote location.
  • C. Overview: The classification reveals trends and provides pointers for possible research directions.
  • From Local to Remote Attacks: Smartphone side-channel attacks are shifting from local smart-card attacks toward remote attacks exploiting both hardware properties and software features.
  • From Local to Remote Attacks: Remote attacks can target millions of devices simultaneously by distributing malicious software through app markets.
  • From Active to Passive Attacks: Smartphone fault attacks are less widely investigated than in the smart-card era because devices are more expensive and remote fault induction is harder.
  • From Active to Passive Attacks: Rowhammer is currently the only software-induced fault attack, although some microarchitectural attacks can actively slow victim execution without causing computation faults.
  • Empty Areas: The survey identifies an uncovered category: remote active attacks exploiting logical properties to induce faults or influence victim programs.

VIII. DISCUSSION OF COUNTERMEASURES

The paper reviews countermeasures for cryptographic implementations and user-input attacks, while emphasizing the need for more generic defenses against side-channel attacks.

  • Overall Objective: The countermeasure discussion aims to expose pitfalls in existing defenses and stimulate research into more generic protections.
  • Protecting Cryptographic Implementations: Countermeasures for cryptographic implementations include masking and execution randomization against passive attacks, plus duplicate execution to detect injected faults.Masking randomizes key-dependent values during cryptographic operations.
  • Protecting User Input: User-input defenses include randomized vibrator timing and randomized soft-keyboard layouts to hinder sensor monitoring and smudge attacks.These techniques target attacks against touchscreen input and device movements.

B. Vicinity Side-Channel Attacks

The discussion surveys defenses across network, permission, sensor, audio, microarchitectural, and software-only attacks, highlighting trade-offs, generic approaches, and deployment challenges.

  • Preventing Network Traffic Analysis: Network-traffic obfuscation requires cooperation between applications and remote servers and adds bandwidth overhead.
  • Permissions: Permission-based defenses are difficult to deploy because users may not understand or care about permissions, and dedicated permissions cannot cover every exploited resource.
  • Limiting Access or Sampling Frequency: Restricting sensor access or sampling frequency can hinder applications that rely heavily on sensor readings, such as pedometers.
  • Preventing Microarchitectural Attacks: Generic countermeasures against cache attacks remain a non-trivial challenge because shared architectural resources expose cryptographic and non-cryptographic information.The paper specifically notes risks to keystrokes as well as cryptographic algorithms.
  • App Guardian: App Guardian uses side-channel information to detect software-only attacks and pauses potentially malicious applications while protected applications execute.It is presented as a more general approach than defenses targeting individual attacks.
  • Summary: Remote attacks require software execution on the target device, making generic defenses such as App Guardian promising for broader-scale protection.

X. CONCLUSION

The paper surveys mobile side-channel attacks and introduces a classification system to organize information leaks and exploitation techniques systematically.

  • Conclusion: The survey identifies commonalities among existing mobile side-channel attacks to categorize them systematically.
  • Conclusion: The classification system is intended to improve understanding of information leaks and exploitation techniques.
  • Conclusion: The paper aims to spur further research on side-channel attacks and countermeasures toward secure computing platforms.
Loading 1611.03748v3…