New side channels targeted at passwords

Albert Tannous, Jonathan Trostle, Mohamed Hassan, Stephen E. McLaughlin, Trent Ray Jaeger

Research output: Contribution to journalConference article

4 Citations (Scopus)

Abstract

Side channels are typically viewed as attacks that leak cryptographic keys during cryptographic algorithm processing, by observation of system side effects. In this paper, we present new side channels that leak password information during X Windows keyboard processing of password input. Keylogging is one approach for stealing passwords, but current keylogging techniques require special hardware or privileged processes. However, we have found that the unprivileged operation of modifying the user key mappings for X Windows clients enables a side channel sufficient for unprivileged processes to steal that user's passwords, even enabling the attacker to gain root access via sudo. We successfully tested one version on Linux 2.6; we were able to obtain a high degree of control over the scheduler, and thus we can obtain accurate timing information. A second version (logon detection) works without depending on accurate clocks or cache effects. Thus, in addition to demonstrating new side channels, we show that (a) side channels cannot be eliminated by removing accurate clocks or hardware cache mechanisms (b) side channels are of continued concern for computer security as well as cryptographic processing.

Original languageEnglish (US)
Article number4721543
Pages (from-to)45-54
Number of pages10
JournalProceedings - Annual Computer Security Applications Conference, ACSAC
DOIs
StatePublished - Dec 1 2008
Event24th Annual Computer Security Applications Conference, ACSAC 2008 - Anaheim, CA, United States
Duration: Dec 8 2008Dec 12 2008

Fingerprint

Clocks
Processing
Hardware
Security of data
Linux

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Cite this

Tannous, Albert ; Trostle, Jonathan ; Hassan, Mohamed ; McLaughlin, Stephen E. ; Jaeger, Trent Ray. / New side channels targeted at passwords. In: Proceedings - Annual Computer Security Applications Conference, ACSAC. 2008 ; pp. 45-54.
@article{753c683cd352400ab4e16620c6aae7d2,
title = "New side channels targeted at passwords",
abstract = "Side channels are typically viewed as attacks that leak cryptographic keys during cryptographic algorithm processing, by observation of system side effects. In this paper, we present new side channels that leak password information during X Windows keyboard processing of password input. Keylogging is one approach for stealing passwords, but current keylogging techniques require special hardware or privileged processes. However, we have found that the unprivileged operation of modifying the user key mappings for X Windows clients enables a side channel sufficient for unprivileged processes to steal that user's passwords, even enabling the attacker to gain root access via sudo. We successfully tested one version on Linux 2.6; we were able to obtain a high degree of control over the scheduler, and thus we can obtain accurate timing information. A second version (logon detection) works without depending on accurate clocks or cache effects. Thus, in addition to demonstrating new side channels, we show that (a) side channels cannot be eliminated by removing accurate clocks or hardware cache mechanisms (b) side channels are of continued concern for computer security as well as cryptographic processing.",
author = "Albert Tannous and Jonathan Trostle and Mohamed Hassan and McLaughlin, {Stephen E.} and Jaeger, {Trent Ray}",
year = "2008",
month = "12",
day = "1",
doi = "10.1109/ACSAC.2008.47",
language = "English (US)",
pages = "45--54",
journal = "Proceedings - Annual Computer Security Applications Conference, ACSAC",
issn = "1063-9527",

}

New side channels targeted at passwords. / Tannous, Albert; Trostle, Jonathan; Hassan, Mohamed; McLaughlin, Stephen E.; Jaeger, Trent Ray.

In: Proceedings - Annual Computer Security Applications Conference, ACSAC, 01.12.2008, p. 45-54.

Research output: Contribution to journalConference article

TY - JOUR

T1 - New side channels targeted at passwords

AU - Tannous, Albert

AU - Trostle, Jonathan

AU - Hassan, Mohamed

AU - McLaughlin, Stephen E.

AU - Jaeger, Trent Ray

PY - 2008/12/1

Y1 - 2008/12/1

N2 - Side channels are typically viewed as attacks that leak cryptographic keys during cryptographic algorithm processing, by observation of system side effects. In this paper, we present new side channels that leak password information during X Windows keyboard processing of password input. Keylogging is one approach for stealing passwords, but current keylogging techniques require special hardware or privileged processes. However, we have found that the unprivileged operation of modifying the user key mappings for X Windows clients enables a side channel sufficient for unprivileged processes to steal that user's passwords, even enabling the attacker to gain root access via sudo. We successfully tested one version on Linux 2.6; we were able to obtain a high degree of control over the scheduler, and thus we can obtain accurate timing information. A second version (logon detection) works without depending on accurate clocks or cache effects. Thus, in addition to demonstrating new side channels, we show that (a) side channels cannot be eliminated by removing accurate clocks or hardware cache mechanisms (b) side channels are of continued concern for computer security as well as cryptographic processing.

AB - Side channels are typically viewed as attacks that leak cryptographic keys during cryptographic algorithm processing, by observation of system side effects. In this paper, we present new side channels that leak password information during X Windows keyboard processing of password input. Keylogging is one approach for stealing passwords, but current keylogging techniques require special hardware or privileged processes. However, we have found that the unprivileged operation of modifying the user key mappings for X Windows clients enables a side channel sufficient for unprivileged processes to steal that user's passwords, even enabling the attacker to gain root access via sudo. We successfully tested one version on Linux 2.6; we were able to obtain a high degree of control over the scheduler, and thus we can obtain accurate timing information. A second version (logon detection) works without depending on accurate clocks or cache effects. Thus, in addition to demonstrating new side channels, we show that (a) side channels cannot be eliminated by removing accurate clocks or hardware cache mechanisms (b) side channels are of continued concern for computer security as well as cryptographic processing.

UR - http://www.scopus.com/inward/record.url?scp=60649096271&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=60649096271&partnerID=8YFLogxK

U2 - 10.1109/ACSAC.2008.47

DO - 10.1109/ACSAC.2008.47

M3 - Conference article

AN - SCOPUS:60649096271

SP - 45

EP - 54

JO - Proceedings - Annual Computer Security Applications Conference, ACSAC

JF - Proceedings - Annual Computer Security Applications Conference, ACSAC

SN - 1063-9527

M1 - 4721543

ER -