A survey of electromagnetic side-channel attacks and discussion on their case-progressing potential for digital forensics

Abstract

The increasing prevalence of Internet of Things (IoT) devices has made it inevitable that their pertinence to digital forensic investigations will increase into the foreseeable future. These devices produced by various vendors often posses limited standard interfaces for communication, such as USB ports or WiFi/Bluetooth wireless interfaces. Meanwhile, with an increasing mainstream focus on the security and privacy of user data, built-in encryption is becoming commonplace in consumer-level computing devices, and IoT devices are no exception. Under these circumstances, a significant challenge is presented to digital forensic investigations where data from IoT devices needs to be analysed.This work explores the electromagnetic (EM) side-channel analysis literature for the purpose of assisting digital forensic investigations on IoT devices. EM side-channel analysis is a technique where unintentional electromagnetic emissions are used for eavesdropping on the operations and data handling of computing devices. The non-intrusive nature of EM side-channel approaches makes it a viable option to assist digital forensic investigations as these attacks require, and must result in, no modification to the target device. The literature on various EM side-channel analysis attack techniques are discussed -selected on the basis of their applicability in IoT device investigation scenarios. The insight gained from the background study is used to identify promising future applications of the technique for digital forensic analysis on IoT devices -potentially progressing a wide variety of currently hindered digital investigations.

A State-of-the-Art Review on the Security of Mainstream IoT Wireless PAN Protocol Stacks

“…A possible research direction could be the use of physical side-channel analysis for also defending intrusions against such devices. In fact, this idea is not new, as it has already been explored in recent works mainly for industrial and other kind of IoT devices [99][100][101][102]. (n)…”

SoK

“…These algorithms require the EM traces to be precisely aligned in the time-domain in order to succeed. Due to the nature of EM trace extraction, minor misalignments often force the attacker to extract more EM traces -this alignment issue can be greatly improved by ML [93]. Furthermore, these algorithms can take a considerable time to complete, making them difficult to be used in live device investigation scenarios in digital forensics [60,107,124].…”

“…There are two potential avenues for EM-SCA that can be assisted by AI techniques; gaining useful insights without accessing the encrypted content, and performing cryptographic key retrieval attacks. Towards the first goal, various AI approaches have been applied using power and electromagnetic side-channel observational data [93]. Knowing whether a target device is running the expected software/firmware can be useful to the investigator, i.e., a malicious user may have modified the firmware.…”

Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices

“…As existing work has shown, software activities running on IoT devices can be detected through EM-SCA techniques. In order to use these attacks for digital forensic purposes, these attacks must work in real-world conditions, such as target devices with zero or minimal knowledge, and devices placed in noisy environments [9].…”

“…However, the firmware of many IoT devices are not updated after they are shipped. Therefore, a known EM side-channel of an IoT device can remain exploitable for the rest of its service life [9].…”