What is a Side Channel Attack ? A way to hack hardware wallets

 

Perhaps the safest way to store passwords right now is to use hardware wallets. Hardware wallets are specially designed to store private keys and passwords and therefore have a very high level of security. One of the strengths of these wallets over software wallets is that they do not have a permanent internet connection. This advantage makes hardware wallets safe from a lot of malware and has a very low probability of being hacked; but in hardware wallets, it is also possible to hack and disclose information, including the phrase recovery, through a side channel attack .

What is a Side Channel Attack ?

Side Channel Attack was first introduced in 1996 by Paul Kocher. In this way, thieves can decrypt and exploit hardware devices by accessing sensitive information. In this way, an attacker could decrypt and steal encrypted keys or details of instructions and data executed on a hardware device.

Lateral channel attacks are a group of attacks on hardware devices. In this method, hackers steal encrypted keys and important information generated by a piece of hardware and can take control of them. In these attacks, the main purpose of hackers is to steal sensitive information of hardware devices by measuring the parameters related to each device such as scheduling information, power consumption, vibration and noise of the device, electromagnetic leakage, light spectra, bandwidth and so on.

This type of attack does not require direct access to hardware devices and can be used to measure and penetrate the range of changes in the parameters of the hacked device using a software and a hardware device. In side channel attacks, hackers use special software and special devices to measure the parameters of a hardware device, such as an oscilloscope, to measure some parameters and exploit them without changing the physical state of the hacked device.

How does a Side Channel Attack occur ?

Hardware-based cryptography is the cornerstone of systems security. The use of hardware for encryption includes the encryption of telephone data, fingerprint storage, credit card and SIM card chips, and hardware wallets for storing digital currencies. Hardware encryption is used on all devices to secure them.

There are different types of side channel attacks, and in each of these attacks, the thief targets and steals a specific type of hardware device information. Lateral channel attacks generally occur in the time interval between sending information between the user and the server; For example, when the user is entering his information on the bank site, financial applications, etc., the thief uses special devices for the frequency of information exchange, power consumption of the device when performing calculations or the time to send a request to the user and checks the response from the server and steals the encrypted information.

No matter what device you are using, thieves can steal your information via cell phone, personal computer, hardware wallet or any other hardware device. To do this, thieves need an antenna to receive information, a device called an oscilloscope to analyze and extract information, and software to decrypt incoming information.

Of course, it is worth noting that side channel attacks are a very complex method and require very expensive devices and many parameters. Because of the high cost of using this method and the need for very high knowledge, this method is often used for thefts much larger than the theft of hardware wallets of ordinary people; but the thief may use this method to steal it, knowing that large amounts of cryptocurrencies are in a wallet.

What is an oscilloscope ?

An oscilloscope is an electronic device for observing the waveform of signals or voltages. The oscilloscope displays the amplitude of the input signals in a two-dimensional diagram. In this diagram, the horizontal axis represents the time and the vertical axis represents the amount of voltage. An oscilloscope is used to accurately display the waveform. In addition to the above, this device can display other parameters such as input pulse width, periodicity, and time interval between two events on its display.

The use of oscilloscopes is not solely for the purpose of sabotage and hacking activities. This device is used in medical sciences, engineering, automotive, telecommunication industry, etc. For example, this device is used to design radio frequency (RF) in the design of electronic circuits of electronic devices or to identify and troubleshoot these devices. This device is also used in the medical industry and is called electrocardiography to show heart rate. .

In lateral canal attacks, an oscilloscope is used to analyze the waves received from the hardware devices. Attackers can access the encrypted keys of hardware devices using a variety of hardware devices, including an electromagnetic wave antenna and an oscilloscope and software to decrypt the information recorded by these devices.

What are the types of side channel attacks?

As mentioned earlier, side channel attacks come in a variety of forms. One of the methods used to steal encrypted information in hardware wallets is timing attack. In this attack, an attacker can obtain encrypted information by measuring the execution time of an algorithm on hardware and performing calculations to decrypt it.

In a time-based attack, an attacker can calculate the time of each bit, calculate a key, and retrieve it. In cryptographic algorithms such as RSA, which require large numbers, this method can be used to extract and decrypt keys by checking the time in cryptography by calculating zero or one bit. The method used in the RSA encryption algorithm is a linear relationship and the attacker can extract the number of 1 bits in these keys and decrypt the device by using the timing to perform calculations on the RSA keys.

In general, a side channel attack can be attributed to any attack in which an attacker uses indirect devices to retrieve an encrypted key by means of various devices. Types of lateral channel attacks can be divided into the following categories.

• Power analysis attacks
• Timing attacks
• Electromagnetic attacks (EM attacks)

Timing attack

In cryptography, a planning assault is a side-direct assault where the assailant endeavors to think twice about cryptosystem by examining the time taken to execute cryptographic calculations. Each consistent activity in a PC invests in some opportunity to execute, and the time can vary in view of the contribution; with exact estimations of the ideal opportunity for every activity, an aggressor can work in reverse to the info. Observing insider facts through planning data might be altogether simpler than utilizing cryptanalysis of known plaintext, ciphertext sets. Once in a while timing data is joined with cryptanalysis to expand the pace of data spillage.

Data can spill from a framework through estimation of the time it takes to react to specific inquiries. How much this data can help an assailant relies upon numerous factors: cryptographic framework plan, the CPU running the framework, the calculations utilized, grouped execution subtleties, timing assault countermeasures, the precision of the circumstance estimations, and so forth Timing assaults can be applied to any calculation that has information subordinate planning variety. Eliminating timing-conditions is troublesome in certain calculations that utilization low-level activities that oftentimes show changed execution time.

Timing assaults are frequently neglected in the plan stage since they are so reliant upon the execution and can be presented unexpectedly with compiler improvements. Aversion of timing assaults includes plan of consistent time capacities and cautious testing of the last executable code.

What are side channel attacks on hardware wallets?

Side channel attacks are one of the most effective ways to attack secure hardware such as cryptocurrency wallets. This is because instead of attacking the encrypted algorithm itself, which is well-protected against attacks, the attacker targets the side channels of the algorithm, which are less secure than the algorithm itself.

Implementing security algorithms on hardware devices is very difficult and costly, which is why hardware wallet companies often do not spend much money on it; If these companies want to protect their products against such attacks, they must not only prove the execution time of the orders and stop any electromagnetic leakage, but also limit any loading and unloading of information in the physical memory, which requires Executes software and major changes to encrypt the structure of hardware wallets. These measures also cause the price of these wallets to increase a lot and there is no economic justification for buyers.

It is almost impossible to do all the work to prevent leakage of the side channels while maintaining the cost of production and safe operation. For example, in the field of cryptocurrencies in 2015, a person named Jochen Hoenicke was able to recover the private key of the Bitcoin wallet of the Trezor hardware wallet using a powerful side channel attack.

In general, security experts believe that it is possible to recover private keys using various methods of side channel attacks, and although the encrypted algorithm of blockchain networks is impenetrable, even the safest way to protect digital currencies is hardware wallets against attack. Lateral channels are not secure.

According to cryptocurrencies experts, hardware wallets are vulnerable to side channel attacks, and attackers can retrieve private keys in these wallets through these attacks; but the question here is, how much does such an attack cost and how much effort does it take? This is a key point in measuring the capabilities of cryptographic hardware chips.

Encrypted chips generally receive a security certificate based on the set of cost and skills required by the attacker to recover the encrypted keys. The higher the certification of a device, the more expensive it will be for the attacker to recover the encrypted keys of that device. The more valuable the private keys of a device and the higher its certification level, the more expensive the hardware used in it due to the development and implementation of counter-attack countermeasures, and naturally the price of the device will be much higher than other devices.

What are the ways to prevent lateral canal attacks?

The use of side channel attacks is not limited to the area of ​​hardware cryptocurrencies and wallets, and can be used to capture any piece of hardware. However, the solution to prevent these attacks is more up to the hardware companies.

Hardware wallet companies, for example, need to use more powerful chips to prevent data leaks from the side channels of their devices. One way they can take advantage of such attacks is to add metal chips and a large number of different capacitors to filter information leaks from hardware wallets. Also, by strengthening the hardware chips and implementing more sophisticated methods to increase speed, keep command execution time constant, etc., lateral channel attacks can be prevented.

Users can also greatly increase the security of their wallets by updating the firmware of their wallets. By updating the firmware of software wallets, the bugs and security problems of these wallets identified by their creators will be fixed and their security will increase with each update.

In conclusion

Lateral channel attacks are one of the attacks by which an attacker can decrypt sensitive information, including data encrypted on various hardware devices. There are also side channel attacks in the world of cryptocurrencies, and thieves can attack one of the safest ways to keep digital currencies, hardware wallets, and steal users’ passwords.