Timothy Claeys
ABSTRACT
This paper investigates thermal covert channels in the context of the Internet-of-Things. More, precisely we demonstrate such a channel on BLE-enabled devices. We explain how the core design principles of BLE link-layer protocol, combined with well-timed intensive CPU calculations can be leveraged to mount a thermal covert channel between two devices.
We implement the attack on three different hardware architectures, a Raspberry Pi 3B, a Motorola X 2014 and an iPhone 5s, and analyze the performance of the channel. We show that we have a similar throughput as previous comparable work, but we greatly improve the range of the channel.
- 2012. IEEE 802.15.4e Low-Rate Wireless Personal Area Networks (Amendment to IEEE Std 802.15.4-2011). IEEE Standards Office, New York, NY, USA.Google Scholar
- Bluetooth SIG 2010. Bluetooth Core specification 4.0. Bluetooth SIG.Google Scholar
- Bluetooth SIG 2016. Bluetooth Core specification 5.0. Bluetooth SIG.Google Scholar
- Raj Chandra Bose and Dwijendra K Ray-Chaudhuri. 1960. On A Class of Error Correcting Binary Group Codes. Information and control 3, 1 (1960), 68--79.Google Scholar
- Cypress Semiconductor Corporation 2016. BCM4334: Single Chip IEEE 802.11 a/b/g/n MAC/Baseband/Radio with Integrated Bluetooth 4.0 + HS and FM Receiver. Cypress Semiconductor Corporation. http://www.rumjd.com/Attachments/20160820160827_152216_171.pdfGoogle Scholar
- Cypress Semiconductor Corporation 2018. CYW43438: Single-Chip IEEE 802.11 b/g/n MAC/Baseband/Radio with Integrated Bluetooth 4.2. Cypress Semiconductor Corporation.Google Scholar
- Atis Elsts, Simon Duquennoy, Xenofon Fafoutis, George Oikonomou, Robert Piechocki, and Ian Craddock. 2016. Microsecond-Accuracy Time Synchronization Using the IEEE 802.15.4 TSCH Protocol. In IEEE SenseApp 2016-Eleventh IEEE International Workshop on Practical Issues in Building Sensor Network Applications.Google ScholarCross Ref
- Fluke 2003. 175, 177, 179 True-rms Multimeters: User manual. Fluke. https://www.instrumart.com/assets/179-manual.pdfGoogle Scholar
- Raspberry Pi Foundation. 2016. Raspberry Pi 3B. https://www.raspberrypi.org/products/raspberry-pi-3-model-b/Google Scholar
- Great Scott Gadgets. 2018. Project Ubertooth. https://github.com/greatscottgadgets/ubertooth/Google Scholar
- Carles Gomez, Joaquim Oller, and Josep Paradells. 2012. Overview and Evaluation of Bluetooth Low Energy: An Emerging Low-Power Wireless Technology. Sensors 12, 9 (2012), 11734--11753.Google ScholarCross Ref
- Mordechai Guri, Matan Monitz, Yisroel Mirski, and Yuval Elovici. 2015. BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations. In 28th IEEE Computer Security Foundations Symposium (CSF). 276--289. Google ScholarDigital Library
- Gareth Halfacree. {n. d.}. Benchmarking the Raspberry Pi 3 B+. https://medium.com/@ghalfacree/benchmarking-the-raspberry-pi-3-b-plus-44122cf3d806Google Scholar
- IFIXIT. {n. d.}. iPhone 5s Teardown. https://nl.ifixit.com/Teardown/iPhone+5s+Teardown/17383Google Scholar
- IFIXIT. {n. d.}. Motorola Moto X Teardown. https://nl.ifixit.com/Teardown/Motorola+Moto+X+Teardown/16867Google Scholar
- APPLE IFIXIT. 2013. The Teardown: Apple iPhone 5s. 8 (November 2013). Issue 10.Google Scholar
- Ramya Jayaram Masti, Devendra Rai, Aanjhan Ranganathan, Christian Müller, Lothar Thiele, and Srdjan Capkun. 2015. Thermal Covert Channels on Multi-core Platforms. In USENIX Security Symposium. 865--880. Google ScholarDigital Library
- Elodie Morin, Mickael Maman, Roberto Guizzetti, and Andrzej Duda. 2017. Comparison of the Device Lifetime in Wireless Networks for the Internet of Things. IEEE Access 5 (2017), 7097--7114.Google ScholarCross Ref
- Steven J. Murdoch. 2006. Hot or Not: Revealing Hidden Services by their Clock Skew. In 13th ACM conference on Computer and communications security. ACM, 27--36. Google ScholarDigital Library
- Lily Hay Newman. 2018. Inside the Unnerving Supply Chain Attack that Corrupted CCleaner. https://www.wired.com/story/inside-the-unnerving-supply-chain-attack-that-corrupted-ccleaner/Google Scholar
- NXP Semiconductors 2015. LPC1759/58/56/54/52/51:32-bit ARM Cortex-M3 MCU; up to 512 kB flash and 64 kB SRAM with Ethernet, USB 2.0 Host/Device/OTG, CAN. NXP Semiconductors. https://www.nxp.com/docs/en/data-sheet/LPC1759_58_56_54_52_51.pdfGoogle Scholar
- Qualcomm Technologies, Inc 2014. Qualcomm Snapdragon 801 Processor. Qualcomm Technologies, Inc. https://www.qualcomm.com/media/documents/files/snapdragon-801-processor-product-brief.pdfGoogle Scholar
- Qualcomm Technologies, Inc 2017. WCN3680B/WCN3660B: device specification. Qualcomm Technologies, Inc. https://developer.qualcomm.com/download/sd410/wcn3680b-wcn3660b-device-spec.pdfGoogle Scholar
- Magic Blue UU. {n. d.}. Bluetooth Bulb. https://www.gearbest.com/smart-light-bulb/pp_230349.htmlGoogle Scholar
- Royyan Wijaya, Viktor Vorobyev, and Sandra. 2017. The Noun Project - Icons for Everything. https://thenounproject.com/Google Scholar
Index Terms
- Thermal covert channel in bluetooth low energy networks
Recommendations
Adaptive ternary timing covert channel in IEEE 802.11
Covert channel is one of the most interesting topics in the computer networks security. Covert channel designers are seeking to discover weaknesses in the communications algorithms to use them as the medium for covert transmission. Broadcast nature of ...
An 802.11 MAC layer covert channel
For extremely sensitive applications, it may be advantageous for users to transmit certain types of data covertly over the network. This provides an additional layer of security to that provided by the different layers of the protocol stack. In this ...
Out-of-Band Covert Channels—A Survey
A novel class of covert channel, out-of-band covert channels, is presented by extending Simmons’ prisoners’ problem. This new class of covert channel is established by surveying the existing covert channel, device-pairing, and side-channel research. ...
Comments