Security: Unintended networks; miscellaneous topics


On Day 1 we noted that a window pane can carry a conversation out of a room whether or not anyone designed it to. Today we take that idea seriously for a whole class. If a network is any system of nodes that conveys data, then networks are everywhere, and many of them were never intended to exist — light, sound, heat, vibration, power draw, timing, and human behavior all carry information out of systems we thought were closed. The organizing principle is simple and unsettling: if something can be observed in any way, there is a good chance it can be exploited.

Slides from class

Files:

Additional information:

Agenda

These notes cover bugs and side channels, humans as information-leaking networks, physical security, and a wrap-up of the course.

Notes

Networks are everywhere

Broaden the definition of a network to "a system of nodes that conveys data" and the subject stops being about computers transmitting bits over wire, fiber, or air according to well-defined protocols. Other ways of transferring data exist, and sometimes they are unintended.

The attack vectors we'll work through today:

A sample of what people have done with these: smudge and residual heat attacks recover PINs from touchscreens; clock skew identifies individual devices; physical-layer manufacturing imperfections fingerprint devices; keystrokes are recoverable by many routes including vibration; a smart watch detects what its wearer is doing. Adversaries are clever.

Emanations, side channels, and covert channels

An important distinction, because the defenses differ:

EMSEC (emission security), part of the broader COMSEC, attempts to prevent compromising emissions — where "compromising" covers both leaks and attacks. It has several strands:

Bugs

A bug captures audio, video, or keystrokes. Simple ones use AM or FM transmission, run on batteries for days or weeks, and cost a few dollars. Are they easy to detect? Fairly — one classic technique is to play unusual music in the room, then use a panoramic receiver to look for spikes in the spectrum and tune to them. If you hear your own music, you've found your bug.

Two more interesting cases.

The Great Seal bug: a carving of the Great Seal of the United States, presented to the US ambassador in Moscow by Soviet schoolchildren, which he hung in his office. Inside was a resonant cavity that acted as a microphone when illuminated by RF energy from outside. No battery, no active electronics, nothing to detect when it wasn't being used — which is why it worked for years.

The laser microphone

We met this on Day 1, and it's worth the full treatment now that we understand the physics. Shine a laser at a window from outside the building. Sound inside the room vibrates the glass; those vibrations change the path length of the reflected beam by a tiny amount; accurate distance measurement at the receiver recovers the vibration, and therefore the audio.

Nobody installed a network. The window is now a communication medium carrying the conversation out of the room. Note also that unlike most of today's attacks, the laser microphone is active — the attacker is emitting something, which in principle can be detected.

Countermeasures worth thinking through: double-pane windows (two surfaces vibrating differently), curtains, deliberately vibrating the glass to add noise, and planting trees to block line of sight.

The passive versions are more alarming. Researchers have recovered intelligible audio by optically observing the vibration of plant leaves, a bag of potato chips (MIT, over a decade ago), and a hanging lightbulb (the Lamphone work). No laser required — just a camera or photodetector and an object in the room that moves slightly when someone speaks.

Acoustic side channels

Sound leaks a surprising amount:

Bugs in unexpected places

Not everything that spies on you was designed to. A keystroke logger can be built into a cable on a desktop, which is genuinely hard to discover. The Furby toy listened and randomly repeated conversations, and was banned by the NSA. The Cayla talking doll was banned in Germany because it could talk to children. A Roomba maps your home — and researchers showed its lidar sensor can be turned into a laser microphone, picking up voice conversations.

But the greatest bug is probably the one in your pocket. A phone has a microphone, several radios (cellular, Wi-Fi, Bluetooth, NFC), an accelerometer, a light sensor, and a battery indicator. Academic work has used the accelerometer or microphone to determine keystrokes, reflections of the screen in glasses or eyeballs to recover typed input, and battery level alone to infer a route of travel. The practical posture: assume the phone is infected with malware.

Exfiltration and countermeasures

A bug only matters if the data gets out. Sometimes it's stored locally and the adversary returns to collect it; more often it's transmitted by RF — AM, FM, or Wi-Fi.

Technical Surveillance Countermeasures (TSCM) is the practice of finding these. Bug sweeps use surveillance receivers that scan the spectrum from roughly 10 kHz to 6 GHz every few seconds, looking for unexplained signals, plus non-linear junction detectors, which find semiconductors whether or not they're transmitting.

The hard cases are exactly the ones we studied earlier in the term: frequency hoppers (recall Bluetooth), spread spectrum, burst transmitters, and low probability of intercept designs. Sweeping every few seconds finds a continuous transmitter; it does not reliably find something that transmits for a few milliseconds once an hour on a frequency you weren't watching.

Light as a channel

Screen brightness is a working covert channel for getting data off an air-gapped workstation — a machine deliberately not connected to any network. Assume software has been installed on it (bait a USB drive and wait). The malware then varies the screen's brightness imperceptibly to a human, encoding data that a camera with line of sight can recover. It's slow, and it works.

Countermeasure: don't get infected. Control removable media. Once code is running on the machine, the air gap is protecting less than you think, because the machine has a screen and the screen is a transmitter.

Other optical channels, all passive:

Cameras

Hidden cameras in rented rooms are a recurring problem, and the detection methods are a nice application of course material. Do a visual search for anything out of place; look for the glint from a lens; and — the networking approach — watch for video feeds from known camera manufacturers by checking the OUI in the MAC addresses of nearby Wi-Fi traffic. Most cheap cameras just stream over Wi-Fi, and the first three bytes of a MAC address name the manufacturer.

If you find one, call the authorities. And note that the same knowledge cuts the other way: a deauthentication attack can repeatedly knock a Wi-Fi camera off the network, which is how a security camera gets defeated. The countermeasure is wired cameras.

Tempest and Van Eck phreaking

Tempest covers sound and vibration but is usually associated with RF. Wim Van Eck published research in 1985 reconstructing the text displayed on a CRT from its leaked RF emissions. The mechanism: the electron gun sweeps across the screen striking phosphors, and that creates an emanation which can be picked up remotely — through walls, and via sprinkler pipes and power lines, which act as unintended antennas. Exploiting this is Van Eck phreaking.

Flat screens are often assumed immune. They aren't — text has been recovered from a laptop's RF emanations — though the attacker must be in relatively close physical proximity, and the equipment is expensive. This cannot be done over the Internet.

Governments manage the risk with Tempest zones, which specify the range beyond which given equipment should not be exploitable: 

Zone    Range
0       1 meter
1       20 meters
2       120 meters
3       1200 meters      (most commercial equipment)

The reasoning behind zones is economic, and worth noting as a general security lesson: shielding everything would cost billions, and there turned out to be almost no real attacks except against high-value targets. So shield only the equipment that needs it, and use distance for the rest.

Timing, power, and glitching

Timing attacks

RSA exponentiation is done one bit at a time, and if the bit is 1 the algorithm performs a multiplication — so processing a 0 bit is faster than processing a 1. That single asymmetry is enough. Guess the exponent one bit at a time, measure how long the operation takes, and repeated observations of decryptions reveal the private key. Brumley and Boneh recovered an OpenSSL private key from Apache servers in about a million decryptions.

The defense is blinding — randomizing the operation so the timing carries no information about the key. OpenSSL had it; Apache wasn't using it. Symmetric algorithms are vulnerable too, via cache misses.

Note what's remarkable here: the cryptography was not broken. The mathematics held perfectly and the key leaked anyway, through the implementation.

Power analysis

Power analysis (rail noise analysis) measures a device's current draw, and it's simple to implement: put a resistor on the ground line and connect a digital oscilloscope. Because different operations draw different amounts of current, you can guess a password one byte at a time, homing in on the correct value by watching the draw. This has been demonstrated against car immobilizers.

The same channel has a defensive use: Wattsupdoc detects malware on embedded medical devices by plugging them into a special outlet, measuring power draw, comparing against normal usage patterns, and alerting on deviation. Anomaly detection, at the electrical layer.

Glitching

Glitching injects a short transient voltage — typically 1 V to tens of volts, lasting a few nanoseconds — at exactly the right moment to disrupt a chip's operation. Timed well, it can cause the processor to skip a few lines of boot code, or skip an authentication step such as the code that asks for a PIN. This was used against the Xbox 360 and PlayStation, and needs only an FPGA and hobbyist hardware.

A striking variant: Light Commands. Aim a laser at the MEMS microphone in a Google Home or Amazon Alexa and you can inject voice commands from across the street — the microphone's diaphragm responds to the light (by electro-optical effect, or possibly heat) as though it were sound. "Hey Google, open my garage," delivered silently through a window, by something that isn't a voice.

SCIFs

A Sensitive Compartmented Information Facility (SCIF) is a room built to defeat the whole catalog above. Physical access is tightly controlled and requires appropriate clearance; the facility is shielded against side channels; and it is regularly swept and monitored for bugs.

Which is a useful summary of the day: when the threats are emanations through arbitrary physical media, the only comprehensive answer is to control the physical environment completely.

Humans as networks

People and their activities leak information too, often more cheaply than any technical attack.

Social activity as signal. Military pizza orders spiking has famously preceded operations. Cell phone location data can reveal visits to medical specialists (a clinic visit implies a condition), political affiliation, participation in demonstrations, associates, and — in one New York Times investigation — murder suspects. On a military base, foot traffic patterns can reveal where the runway is.

Social engineering at scale. The NYT investigated who makes all those scam calls. The pattern: the scammer calls a victim pretending to be a computer company offering a refund for discontinued antivirus, then gets the victim to install remote desktop software. (In the story, a researcher turned this around by installing software on the scammer's own machine to watch.) Note that no technical vulnerability was involved at any point.

Inference from appearance. An algorithm has claimed to infer political orientation from naturalistic facial images at 72% accuracy, against 55% for human judges. Related claims: emotions at 94%, sexual orientation at 91%, personality at 64%. From a photo of a face. Whether or not you believe the accuracy figures, the existence of the claims changes what a photograph is.

Re-identification. Netflix released an anonymized dataset of 500,000 subscribers for a prediction competition — no personally identifiable information, just subscriber IDs and movie ratings. Researchers cross-referenced it with public IMDB ratings and identified individual subscribers with high probability, using the ratings and dates common to both. They also inferred political preferences, religious affiliation, and sexual orientation. A parallel result: 95% of individuals can be positively identified from location traces alone.

The lesson generalizes and is worth stating plainly: "anonymized" is a claim about one dataset in isolation, and datasets do not stay in isolation. This is the "value" V from Day 1's five V's of big data — extracting value by correlating with other data — viewed as a privacy failure.

Physiological signals. We saw on Day 11 that Vital-Radio transmits an RF signal and measures time of flight to detect the small distance changes caused by breathing, yielding respiration and heart rate. Newer work does it from background transmissions. And it can be done with plain video: subtle color changes in the face reveal pulse (there are consumer apps for this).

Consider the implications. An employer could measure your pulse and respiration during a meeting without your knowledge or consent. An insurer could use it to set rates. The FBI-style question of whether someone is anxious or lying becomes a passive measurement.

Passive and active collection

Just by observing. Look at a stranger's car: bumper stickers give hobbies, political affiliation, and radio station; family stick figures give household composition and pets; a fraternity decal names an institution. Look at someone's desk: flags suggest nationality and travel, souvenirs suggest where they've been, the screen reveals the OS. And in a building lobby, observe clothing, entries and exits, entry requirements, perimeter security, security staff, and the lobby setup.

Being slightly more active reveals more, with correspondingly higher risk of detection: dumpster diving, eavesdropping, shoulder surfing, baiting (leaving media to be picked up), and tailgating (following someone through a controlled door). The defenses are mostly procedural: cross-cut shredding, awareness of surroundings, polarized screen covers (some firms tell consultants not to work on planes at all), teaching people not to plug in found devices, and a policy that nobody holds the door.

EXIF data. Photos often embed the latitude and longitude where they were taken. Facebook strips EXIF out of what it publishes — while retaining it for its own purposes. What would an adversary do with it? Among other things, use it to build rapport with a target, which is the first step of social engineering.

The OSINT Framework collects a large number of tools by purpose. A mundane but illustrative example: you know a company's domain but forgot its email address format; an email format tool correctly reports <firstname>.<lastname>@domain.com. That's a phishing campaign's prerequisite, obtained in one query.

A worked OSINT example. What frequencies does an organization use for its wireless communications? The FCC's license search lets you search by licensee name and returns the call signs and frequencies. Try it with "Dartmouth College." All public, all by design — spectrum licensing is a public record, and one consequence is that anyone can learn where to listen.

Physical security

All the cryptography in the world doesn't help if someone can walk into the room. Several examples, each with countermeasures, because the pattern is what matters.

Doors

A common configuration: card reader on one side, request-to-exit (REX) sensor on the other, so people can leave without badging. The REX is often a passive infrared (PIR) sensor — and here's the flaw: a PIR detects a change in temperature, not an increase. Spray canned air (inverted, so it emits cold) under the door and the PIR fires, unlocking the door from outside. Countermeasures: install gaskets around the door, use a REX combining PIR and microwave sensing, or eliminate the REX and require badging out.

Other physical bypasses: an under-door tool (UDT) reaches under a door to operate the interior handle (countermeasure: a door protector plate); crash bars can often be actuated from outside; and garage doors with 12 DIP switches have only 212 = 4,096 possible codes, which is trivially brute-forced. And don't forget hinge pins — if the hinges are on your side, the lock is irrelevant.

Imagery intelligence

Google Street View is a reconnaissance tool. From a photo of an apartment entrance you can identify the make of the access control unit — a distinctive button layout identifies the manufacturer — and some manufacturers use the same key for every enclosure, obtainable without restriction. Open the case and the postal entry button is often wired up, so pressing it opens the door. You can also scout which proximity cards are used, where cameras are, and how high the perimeter wall is.

Keys from photographs. Physical keys have bitting values — notches cut to standardized depths, typically around five positions with about six possible depths each. Given a photograph of a key, overlay a bitting template, read off the values, and give them to a locksmith or file a blank yourself. So: what mistake is the security guard in the photo making? Wearing his keys visibly. Keep your keys in your pocket, and don't wear badges visibly outside the facility.

Keys without a photograph. Pin tumbler locks have pins set to various depths; an inserted key displaces them, and the correct key aligns them with the shear line so the cylinder turns. Since the bitting sequence is all that matters, if you can learn it by any means you can make a working key. One route: a smartphone microphone recording the sound of a key being inserted — the clicks as the pins pass over the cuts encode the bitting sequence. Another acoustic side channel, this time against a lock.

The countermeasure here isn't a better lock, it's defense in depth: combine locks with door contacts, motion sensors (PIR and microwave), and cameras, so that defeating the lock isn't sufficient.

Proximity cards

Prox cards are the standard for physical access control: short range, and passive — there's no power in the card, which is energized by the reader's field. The card typically contains only an ID with no real computational power; the reader reads the ID, checks whether access is allowed, and opens the door.

Note what "only an ID" means: the card cannot authenticate anything. It answers with its identifier to whatever asks. So a battery-powered mobile reader carried in a bag can capture card data from someone standing nearby — countermeasure: RFID-blocking sleeves.

Worse, credentials can be harvested at the door itself with an ESPKey, a small device wired in behind the reader that records every credential presented and serves them back over Wi-Fi. Tamper alarms (ball or plunger type) exist to detect a reader being opened. Why aren't they connected? Because installers don't want false alarms — the same alarm-fatigue tradeoff we saw with IDS, with the same result: the detection mechanism exists and is switched off.

Wrap up

We've covered a lot of ground. The spine of the course was the layered model: the physical layer moving bits over copper, fiber, and radio; the link layer moving frames within a LAN using MAC addresses; the network layer moving packets between LANs using IP addresses, with forwarding in the data plane and routing in the control plane; the transport layer moving segments and datagrams with ports, and building reliability and congestion control out of nothing but retransmission; and the application layer moving messages according to protocols published in RFCs.

Then security on top of that: cryptography — symmetric keys, hashing, asymmetric keys — composed into TLS (authenticate both ends, exchange a session key asymmetrically, then communicate symmetrically), VPNs (an encrypted tunnel into a private network), and TOR (triple encryption through three nodes so no single party knows sender, receiver, and message). Then defense and assessment: firewalls in four varieties with iptables rules, intrusion detection and prevention, and penetration testing.

And today: the reminder that all of it assumes the data stays inside the channels we designed, which it does not.

Exercises

Nothing to submit, but worth doing:

Terms

Not a comprehensive reference — Anderson's Security Engineering covers most of this in depth — but these are the terms from Day 17 worth keeping.

unintended network
Any system of nodes conveying data that nobody designed to carry it — a window pane, a lightbulb, a power line, a person's shopping habits.
side channel
An accidental information leak through a medium not intended for communication, e.g. recovering an RSA key from acoustic emanations.
covert channel
A deliberate leak through a medium not intended for communication, e.g. modulating screen brightness to exfiltrate data from an air-gapped machine.
EMSEC / COMSEC
Emission security — preventing compromising emissions — as part of the broader field of communications security.
Tempest
Spying on information systems via leaked emanations (RF, sound, vibration), and also the practice of shielding equipment against such spying.
Van Eck phreaking
Reconstructing screen contents from a display's leaked RF emissions, after Van Eck's 1985 CRT result. Works on flat panels too, at short range and high cost.
Tempest zones
Ranges beyond which given equipment should not be exploitable: zone 0 at 1 m, zone 1 at 20 m, zone 2 at 120 m, zone 3 at 1200 m (most commercial equipment). Shield selectively; use distance for the rest.
Great Seal bug
A passive resonant-cavity microphone with no battery or electronics, activated by external RF illumination — undetectable when not in use.
laser microphone
Recovers audio by measuring vibrations of a window (or other surface) via a reflected laser beam. Active, therefore in principle detectable. Countered by double panes, curtains, induced vibration, or blocking line of sight.
Lamphone / passive optical audio recovery
Recovering speech from the vibration of a hanging lightbulb, plant leaves, or a bag of chips, using only a camera or photodetector. Entirely passive.
air gap
Isolating a machine from all networks. Defeated by covert channels once code runs on the machine, since screens, speakers, and power supplies are all transmitters.
TSCM
Technical Surveillance Countermeasures: bug sweeps using surveillance receivers scanning ~10 kHz to 6 GHz and non-linear junction detectors. Defeated by frequency hopping, spread spectrum, burst transmission, and LPI designs.
deauthentication attack
Repeatedly forcing a Wi-Fi device off the network, used to take wireless cameras offline. Countered by wired cameras.
timing attack
Recovering a key by measuring how long operations take — RSA exponentiation is slower for 1 bits than 0 bits. Defeated by blinding. The mathematics is unbroken; the implementation leaks.
power analysis
Measuring current draw (a resistor on the ground line plus an oscilloscope) to infer secret data, e.g. guessing a password byte by byte. Also usable defensively for malware detection.
glitching
Injecting a brief transient voltage at a precise moment to make a chip skip instructions, such as an authentication check. Used against game consoles; needs only hobbyist hardware.
Light Commands
Injecting voice commands into a smart speaker by aiming a laser at its MEMS microphone, from across a street.
SCIF
Sensitive Compartmented Information Facility: access controlled by clearance, shielded against side channels, regularly swept for bugs.
re-identification
Recovering identities from "anonymized" data by correlating it with another dataset, as with the Netflix prize data and public IMDB ratings, or identifying 95% of people from location traces.
EXIF
Metadata embedded in photos, often including the latitude and longitude where the photo was taken.
OSINT Framework
A collection of open source intelligence tools organized by purpose — email format finders, public records searches, and much more.
REX / PIR
Request-to-exit sensor, often implemented as a passive infrared detector. PIR detects a change in temperature, so inverted canned air can trigger it from outside a door.
UDT (under-door tool)
A tool reaching under a door to operate the interior handle. Countered by a door protector plate.
bitting
The sequence of cut depths on a key — roughly five positions with six depths each — which fully determines the key. Recoverable from a photograph, or from the sound of insertion.
prox card
A passive proximity card powered by the reader's field, typically containing only an ID and no ability to authenticate. Capturable by a mobile reader; countered by RFID-blocking sleeves.
ESPKey
A device wired in behind a card reader that harvests every credential presented and serves them wirelessly. Detectable by tamper alarms, which are often left unconnected to avoid false alarms.
defense in depth
Combining independent controls — locks plus door contacts plus motion sensors plus cameras — so defeating any one is insufficient.

This page was generated by Claude from in-class slides.