How to Protect Critical Business Data from Side-channel Attacks

As digital information becomes more valuable, attackers are utilizing increasingly clever and sophisticated ways to steal it. One of the more novel attacks being utilized today takes advantage of flaws in the computer system itself, not just the software running on the computer. This type of attack is referred to as a side-channel attack.

A classic example of a side-channel attack is a timing attack in which a hacker compromises an app by measuring the exact amount of time the app takes when given a certain input. Apps which perform cryptographic operations on sensitive data (like encryption, decryption, and integrity verification) must now be designed to prevent timing from leaving clues that could allow attackers to compromise sensitive data.

These attacks may seem like science fiction, however there are many of cases that have occurred recently. A great example is the Spectre and Meltdown vulnerabilities which exploited a timing related side-channel to allow hackers to access data in nearly every computer manufactured in the past decade.

Even physical resources are at risk. Manufacturing equipment, for instance, might be safe from being remotely compromised, however by using a side channel it is possible to exfiltrate a password or other credentials that would give an attacker access to it.

Side channel attacks are difficult to guard against. However, just as the attacks have become more sophisticated, there are now a variety of ways to mitigate them. Here are a few best practices to help prevent them.

Determine the Risk Profile

The first step in guarding against any kind of cyber-attack is to consider the organization’s risk profile to determine the most sought-after confidential information. Cybersecurity executives should picture their company’s threat model holistically to understand exactly what an attacker would want and the different kinds of attacks that could be used. By doing this, organizations can prioritize protecting the most valuable data and resources from all kinds of attacks, not just those involving side channels.

Always Keep software Updated

Computer processors often contain side-channel vulnerabilities which can be exploited by savvy attackers. However, these attacks are the easiest to protect against because software vendors are usually quick to provide a patch when they become aware of the problem. This was the case with the Meltdown and Spectre vulnerabilities. Keeping up to date with software patches and updates is the best way to mitigate this risk.

Solidify On-premise Security

Computer hardware like monitors and hard drives may emit electromagnetic or acoustic interference that can be used to determine the information displayed or stored on the hardware. These types of attacks can overcome even the most stringent software security policies because they affect the underlying hardware. While measuring tiny sound waves may be too difficult for most attackers, this type of attack should be guarded against if the organization has extremely valuable data to protect.

A far more likely situation presents itself when important information is entered using a keyboard. An attacker could use a wideband antenna to pick up electromagnetic signals transmitted from keyboards while the user types login usernames and passwords. Acoustic signals such as keystroke sounds could also be picked up using laser microphone technology which is now accessible to the public.

These types of attacks can be mitigated with strong on-premise security. For example, physically isolating machines with sensitive information from the rest of a building prevents attackers from getting near enough to pick up sensitive radio or sound interference.

Eliminate Meta Data Leakage

The largest number of attacks occur when information travels over a network. Even if the information itself is encrypted, metadata like the size of files and the time when they were accessed can reveal a lot about the content. A document or web page can be accurately identified by its exact size. Web pages visited using HTTPS, which encrypts page contents to prevent attackers from viewing and modifying it, may be uniquely identifiable by the size of the resources loaded when someone visits that page. A hacker could figure out which web pages employees visit and when, even if they cannot read the actual content transmitted.

A study conducted by Microsoft Research found that attackers could determine a user’s precise medical information through the unique network request signatures made by different parts of a web-based healthcare application. Even though the content was encrypted, the different network signatures produced when users performed certain actions were enough to figure out the information on the user’s screens. This attack is inexpensive and easy to perform. A hacker only needs to be on the same network as the targeted user.

To completely protect against network metadata attacks, web applications should be designed to prevent metadata leaking. Implementing policies to keep potential attackers from connecting to the most sensitive internal network can also mitigate many of these risks.

The Most Effective Cyber Security Defense

There is no simple solution for side channel vulnerabilities. Effectively protecting an organization from these kinds of attacks requires a thorough understanding of the organization’s specific assets and valuable information. When an organization can effectively predict the ways that their assets might be compromised, they can protect their organization from all kinds of malicious activity. Knowing the attacker’s goals and protecting appropriately is the most effective cybersecurity defense.

Here at Outsource IT, we specialize in helping businesses protect their critical data. We utilize security best practices to protect our client’s data and reduce the risk of data compromise from malicious attacks. Contact your account manager to lean more.