4.7 Case Study of the Development …
369
The management of attacks at high frequencies: High-speed 50 MHz data transmission provides additional opportunities to increase the transmission range associated with an increase in frequency. This extended range can easily be created
using the length (number of bits) of the transmitting pin. Since the length of this
pin reaches one-fourth of the carrier wavelength, the quality of the emitted data set
(pattern) increases with increasing level of the radiated energy. And transmission at
even higher frequencies, such as 300 MHz, will significantly increase the transmission distance, but this will have an upper limit due to uncorrectable parasites on the
board as we reach the microwave frequencies, which creates more favorable levels
for the attacker. Typical example: an object infected with a Trojan is located in the
territory of a military facility (missile base) with an extended security zone. Instead
of using the fourth bit of a data rate counter, this hardware Trojan uses a 50 MHz
clock signal to modulate data.
The activation of this type of Trojan allowed the authors of [156] to obtain sensitive
data at a distance of more than 4 feet, using standard equipment of amateur HAM
radio for audio detection of the signal. Decoding the telemetry sequence allowed us
to verify the leakage of correct information. By placing a finger, a pencil, or a strip
of paper on a pin, the developers of this Trojan managed to detect a signal on the
other side of the building, at a distance of about 50 feet. Looking through this data
transmission with an oscilloscope, they found that the signal looks almost identical
to the one shown in Fig. 4.43, except for the indicated change in frequency.
Attack using high-frequency light-emitting diodes: A pattern of the same telemetric signal as for the RF Trojan was used in [156] to extract the secret key using
a high-frequency blinking LED. Here, instead of an “audible” tone, information
was transmitted by two different LED flicker frequencies. The diode flickered at a
frequency of 1 kHz for the case of transmitting a telemetric signal and at a frequency
of 2 kHz to indicate the absence of a signal. In order to make it less noticeable to the
user, the LEDs constantly flickered at high frequency, not allowing the brightness to
change when it switched to transmission mode. The difference between the LEDs
flickering at 1 kHz and 2 kHz is completely imperceptible to the human eye, just
watching the LEDs. A special circuit with a photodiode and a built-in band-pass filter
displays a flicker pattern for the attacker on its own LED, which flickers just as the
telemetry signal is heard to a person using the above-described RF Trojans.
This Trojan needs an additional specialized circuit to “see” data transmission,
shifting the frequencies in LEDs as described above. Any student can see this by
placing a circuit near an LED that is transmitting data, and reading the values when
an LED is observing an external circuit. The external circuit, located a few inches
away from the Alpha device, retrieves the key used to decrypt the secret message.
To conclude this section, examples of the next-generation Trojans should be given,
which were developed by the team [156], but were not implemented. For some of
these Trojans, certain steps were taken to implement them, but either their excessive complexity and potentially destructive nature, or the lack of allocated time and
resources, did not allow to implement them. The following short descriptions are
only general conceptual descriptions of these possible attacks.
Brief description of the concepts of other promising Trojans.
369
The management of attacks at high frequencies: High-speed 50 MHz data transmission provides additional opportunities to increase the transmission range associated with an increase in frequency. This extended range can easily be created
using the length (number of bits) of the transmitting pin. Since the length of this
pin reaches one-fourth of the carrier wavelength, the quality of the emitted data set
(pattern) increases with increasing level of the radiated energy. And transmission at
even higher frequencies, such as 300 MHz, will significantly increase the transmission distance, but this will have an upper limit due to uncorrectable parasites on the
board as we reach the microwave frequencies, which creates more favorable levels
for the attacker. Typical example: an object infected with a Trojan is located in the
territory of a military facility (missile base) with an extended security zone. Instead
of using the fourth bit of a data rate counter, this hardware Trojan uses a 50 MHz
clock signal to modulate data.
The activation of this type of Trojan allowed the authors of [156] to obtain sensitive
data at a distance of more than 4 feet, using standard equipment of amateur HAM
radio for audio detection of the signal. Decoding the telemetry sequence allowed us
to verify the leakage of correct information. By placing a finger, a pencil, or a strip
of paper on a pin, the developers of this Trojan managed to detect a signal on the
other side of the building, at a distance of about 50 feet. Looking through this data
transmission with an oscilloscope, they found that the signal looks almost identical
to the one shown in Fig. 4.43, except for the indicated change in frequency.
Attack using high-frequency light-emitting diodes: A pattern of the same telemetric signal as for the RF Trojan was used in [156] to extract the secret key using
a high-frequency blinking LED. Here, instead of an “audible” tone, information
was transmitted by two different LED flicker frequencies. The diode flickered at a
frequency of 1 kHz for the case of transmitting a telemetric signal and at a frequency
of 2 kHz to indicate the absence of a signal. In order to make it less noticeable to the
user, the LEDs constantly flickered at high frequency, not allowing the brightness to
change when it switched to transmission mode. The difference between the LEDs
flickering at 1 kHz and 2 kHz is completely imperceptible to the human eye, just
watching the LEDs. A special circuit with a photodiode and a built-in band-pass filter
displays a flicker pattern for the attacker on its own LED, which flickers just as the
telemetry signal is heard to a person using the above-described RF Trojans.
This Trojan needs an additional specialized circuit to “see” data transmission,
shifting the frequencies in LEDs as described above. Any student can see this by
placing a circuit near an LED that is transmitting data, and reading the values when
an LED is observing an external circuit. The external circuit, located a few inches
away from the Alpha device, retrieves the key used to decrypt the secret message.
To conclude this section, examples of the next-generation Trojans should be given,
which were developed by the team [156], but were not implemented. For some of
these Trojans, certain steps were taken to implement them, but either their excessive complexity and potentially destructive nature, or the lack of allocated time and
resources, did not allow to implement them. The following short descriptions are
only general conceptual descriptions of these possible attacks.
Brief description of the concepts of other promising Trojans.