EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread
The distinguishing feature of the Internet of Things is that many devices get interconnected. The threat of side-channel attacks in this setting is less understood than the threat of traditional network and software exploitation attacks that are perceived to be more powerful. This work is a case stu...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2018-02-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/833 |
| _version_ | 1818415750095831040 |
|---|---|
| author | Daniel Dinu Ilya Kizhvatov |
| author_facet | Daniel Dinu Ilya Kizhvatov |
| author_sort | Daniel Dinu |
| collection | DOAJ |
| description | The distinguishing feature of the Internet of Things is that many devices get interconnected. The threat of side-channel attacks in this setting is less understood than the threat of traditional network and software exploitation attacks that are perceived to be more powerful.
This work is a case study of Thread, an emerging network and transport level stack designed to facilitate secure communication between heterogeneous IoT devices. We perform the first side-channel vulnerability analysis of the Thread networking stack. We leverage various network mechanisms to trigger manipulations of the security material or to get access to the network credentials. We choose the most feasible attack vector to build a complete attack that combines network specific mechanisms and Differential Electromagnetic Analysis. When successfully applied on a Thread network, the attack gives full network access to the adversary. We evaluate the feasibility of our attack in a TI CC2538 setup running OpenThread, a certified open-source implementation of the stack.
The full attack does not succeed in our setting. The root cause for this failure is not any particular security feature of the protocol or the implementation, but a side-effect of a feature not related to security. We summarize the problems that we find in the protocol with respect to side-channel analysis, and suggest a range of countermeasures to prevent our attack and the other attack vectors we identified during the vulnerability analysis.
In general, we demonstrate that elaborate security mechanisms of Thread make a side-channel attack not trivial to mount. Similar to a modern software exploit, it requires chaining multiple vulnerabilities. Nevertheless, such attacks are feasible. Being perhaps too expensive for settings like smart homes, they pose a relatively higher threat to the commercial setting. We believe our experience provides a useful lesson to designers of IoT protocols and devices. |
| first_indexed | 2024-12-14T11:39:57Z |
| format | Article |
| id | doaj.art-89f6fbe6102b4edcb491de229a072c7f |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-12-14T11:39:57Z |
| publishDate | 2018-02-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-89f6fbe6102b4edcb491de229a072c7f2022-12-21T23:02:52ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252018-02-012018110.13154/tches.v2018.i1.73-97EM Analysis in the IoT Context: Lessons Learned from an Attack on ThreadDaniel Dinu0Ilya Kizhvatov1SnT, University of LuxembourgDigital Security Group, Radboud University NijmegenThe distinguishing feature of the Internet of Things is that many devices get interconnected. The threat of side-channel attacks in this setting is less understood than the threat of traditional network and software exploitation attacks that are perceived to be more powerful. This work is a case study of Thread, an emerging network and transport level stack designed to facilitate secure communication between heterogeneous IoT devices. We perform the first side-channel vulnerability analysis of the Thread networking stack. We leverage various network mechanisms to trigger manipulations of the security material or to get access to the network credentials. We choose the most feasible attack vector to build a complete attack that combines network specific mechanisms and Differential Electromagnetic Analysis. When successfully applied on a Thread network, the attack gives full network access to the adversary. We evaluate the feasibility of our attack in a TI CC2538 setup running OpenThread, a certified open-source implementation of the stack. The full attack does not succeed in our setting. The root cause for this failure is not any particular security feature of the protocol or the implementation, but a side-effect of a feature not related to security. We summarize the problems that we find in the protocol with respect to side-channel analysis, and suggest a range of countermeasures to prevent our attack and the other attack vectors we identified during the vulnerability analysis. In general, we demonstrate that elaborate security mechanisms of Thread make a side-channel attack not trivial to mount. Similar to a modern software exploit, it requires chaining multiple vulnerabilities. Nevertheless, such attacks are feasible. Being perhaps too expensive for settings like smart homes, they pose a relatively higher threat to the commercial setting. We believe our experience provides a useful lesson to designers of IoT protocols and devices.https://tches.iacr.org/index.php/TCHES/article/view/833mesh networkIEEE 802.15.4AES-CCMHMACDPADEMA |
| spellingShingle | Daniel Dinu Ilya Kizhvatov EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread Transactions on Cryptographic Hardware and Embedded Systems mesh network IEEE 802.15.4 AES-CCM HMAC DPA DEMA |
| title | EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread |
| title_full | EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread |
| title_fullStr | EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread |
| title_full_unstemmed | EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread |
| title_short | EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread |
| title_sort | em analysis in the iot context lessons learned from an attack on thread |
| topic | mesh network IEEE 802.15.4 AES-CCM HMAC DPA DEMA |
| url | https://tches.iacr.org/index.php/TCHES/article/view/833 |
| work_keys_str_mv | AT danieldinu emanalysisintheiotcontextlessonslearnedfromanattackonthread AT ilyakizhvatov emanalysisintheiotcontextlessonslearnedfromanattackonthread |