It sounds like something out of an episode of Spooks: Researchers have discovered a way to use simple touch to decode the cryptography keys that are intended to secure your information. It's as easy as gauging the electric potential coursing through your computer while it's working.

In the MIT Technology Review today, we learn of a paper out of Tel Aviv University (title: Get Your Hands Off My Laptop) that details the process of measuring the ground electric potential in laptops. There are several ways to do this: You could, say, use a wire. But that's not nearly as exciting as using your own handpreferably sweaty!and then "analyzing that signal using sophisticated software."

Here's how the authors explain the process:

This potential can be measured by a simple wire, non-invasively touching a conductive part of the laptop (such as the metal heatsink fins or shielding of USB, Ethernet, VGA, DisplayPort and HDMI ports), and connected to a suitable amplifier and digitizer. The chassis potential, thus measured, is affected by ongoing computation, and our attacks exploit this to extract RSA and ElGamal keys, within a few seconds.

According to the researchers, the hand method works "is especially effective in hot weather, since sweaty fingers offer lower electric resistance."

Essentially, they're taking advantage of the "noise" your computer makes while it's processing this information, to figure out exactly when and how they should listen in. Which brings us to an important point: How to resist it. According to MIT, it's "possible to avoid such attacks by adding random data to computations." In other words, we'll need to build codes on top of code. [MIT Technology Review]

Image: Lasse Kristensen.

Read this article:
Scientists Hack Cryptography Keys By Simply Touching a Laptop

The latest way to snoop on a computer is by measuring subtle changes in electrical potential as data is decrypted.

Touch sensitive: In a demonstration, a researcher captures cryptographic keys stored on a computer using a sophisticated algorithm that measures ground potential conducted through the skin.

With enough technical savvy, simply touching a laptop can suffice to extract the cryptographic keys used to secure data stored on it.

The trick is based on the fact that the ground electrical potential in many computers fluctuates according to the computation that is being performed by its processorincluding the computations that take place when cryptographic software operates to decrypt data using a secret key.

Measuring the electrical potential leaked to your skin when you touch the metal chassis of such laptops, and analyzing that signal using sophisticated software, can be enough to determine the keys stored within, says Eran Tromer, a computer security expert at Tel Aviv University.

The remarkable result is described in this paper due to be presented at a conference in South Korea next month, but it was demonstrated Tuesday at a cryptography conference in Santa Barbara, California.

A signal can be picked up by touching exposed metal on a computer chassis with a plain wire. Or that wire can make contact anywhere on the body of an attacker touching the computer with a bare hand (sweaty hands work best). The ground signal can also be measured by fastening an alligator clip at the far end of an Ethernet, VGA, or USB cable attached to the computer, or even wirelessly with sensitive voltage-detection equipment. The catch is that contact must be made as data is unlocked with a keyduring decryption of a folder or an e-mail message, for instance.

Tromer says his research team has used all those methods to extract encryption keys based on widely used, high-security standards4,096-bit RSA keys and 3,072-bit ElGamal keys.

The work contributes to a growing body of evidence that regardless of the software protections people place on computers, there are indirect ways to extract dataso-called side channel attacks.

Previous research efforts have found, for example, that analyzing the power consumption of a computer can reveal cryptographic keys. The good news is that analyzing subtle trends in power usage can also reveal whether a computer is being attacked (see Tiny Changes in Energy Use Could Mean Your Computer Is Under Attack).

The rest is here:
How to Break Cryptography With Your Bare Hands

Ever since the first hack of a commercial quantum cryptography device, security specialists have been fighting back. Heres an update on the battle.

Quantum hacking is the latest fear in the world of information security. Not so long ago, physicists were claiming that they could send information with perfect security using a technique known as quantum key distribution.

This uses the laws of quantum mechanics to guarantee perfectly secure communication. And perfectly secure communication is what you get, at least in theory.

The trouble is that in practice the equipment used to carry out quantum key distribution has a number of weaknesses that an eavesdropper can exploit to gain information about the messages being sent. Various groups have demonstrated how quantum hacking presents a real threat to perfectly secure communication.

So in the cat and mouse game of information security, physicists have been fighting back by designing equipment that is more secure. Today, Nitin Jain at the Max Planck Institute for the Science of Light in Erlangen, Germany, and a few pals show how the changes still leave the equipment open to attack but at the same time reveal how the next generation of quantum cryptography could be made better.

In quantum key distribution, Alice sends information to Bob encoded in the polarisation of single photons. So she might send a sequence of 0s and 1s as a series of photons polarised horizontally and vertically. Bob can then use this information as the key to a one-time pad for sending information with perfect security. Hence the name quantum key distribution.

An eavesdropper, Eve, can only see the information Alice sends if she knows the directions that correspond to vertical and horizontal. Physicists call this the base of the system.

Without knowing the base, the information the photons carry will seem random. So a key part of the security of quantum key distribution comes from keeping Alices base secret.

Just over 10 years ago, hackers found a way for Eve to discover Alices base. All Eve has to do is shine a light into Alices equipment and measure the polarisation of the reflected photons. These will have bounced off the optical components that determine Alices base and so will be polarised in the same way. That gives Eve the crucial information she needs to decode the transmissions without Alice being any the wiser.

View post:
The Next Battleground In The War Against Quantum Hacking