When LoRa Meets EMR: Electromagnetic Covert Channels Can Be Super Resilient

Eavesdropping on Black-box Mobile Devices via Audio Amplifier's EMR

“…It attracts many researchers' attentions of investigating the system vulnerabilities caused by leaking EMRs. Following this line of researches, EMRs have been exploited to infer victim's keystrokes on keyboards [24], [25], [43], profile device memory usages [44], identify the model of LCD monitors [34], recover the displayed information on mobile screens [35], and exfiltrate secret data by establishing electromagnetic covert channel [45]- [47]. In addition, the most recent studies show that fine-grained data processed on the device also have the leakage threats via EMRs.…”

Covert Channel Communication as an Emerging Security Threat in 2.5D/3D Integrated Systems

“…TEMPEST is a shielding standard developed by NATO and the National Security Agency (NSA) that requires systems to be protected with “a 100 dB insertion loss from the frequencies of 1 KHz to 10 GHz” [ 56 ]. However, note that there are techniques that are able to establish covert channels, despite various types of shielding, by manipulating the shape of the frequency spectrum [ 57 ] or focusing on the lower end of the frequency spectrum [ 36 ]. While shielding does provide a physical impediment to the communication medium, the ever-evolving nature of attacks has shown that relying on passive methods does not maintain a guarantee of security.…”

“…Similarly, a three-layer convolutional neural network (CNN) was developed to detect electromagnetic covert channels in [ 57 ]. The CNN was trained by using labeled EM spectra and legitimate/expected system processes.…”

Private Data Exfiltration from Cyber-Physical Systems Using Channel State Information

“…Recently the effective range of EM side-channel communication has been extended using LoRa like modulation for CPU-memory operations. Shen et al [40] have demonstrated EMRLoRA which uses chirp spread spectrum to increase the effective range to approximately 250m and is capable of penetrating shielding. However, this is demonstrated on hardware that is not necessarily available on embedded systems and other low powered devices.…”