Power to peep-all: Inference Attacks by Malicious Batteries on - PowerPoint PPT Presentation

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices Pavel Lifshits, Roni Forte , Yedid Hoshen, Matt Halpern, Manuel Philipose, Mohit Tiwari, and Mark Silberstein Speaker: Pavel Lifshits

SMART BATTERY  Programmability  Sensors: current, voltage, temperature Why?  Safety overheating, over/under voltage  Extend battery life  Performance

SMART BATTERY - PROGRAMMABILITY Software defined battery Smart battery System (SOSP ‘15) See spec. By Microsoft & Tesla http://sbs-forum.org/specs/

INSIDE SMARTPHONE BATTERY Btemp NFC antenna BSI (battery size/status/system indicator)

INSIDE SMARTPHONE BATTERY Your phone batteries are getting smarter!

Do the smart batteries create a new privacy threat?

IF THE ATTACKER GETS ON YOUR BATTERY  Browsing History

IF THE ATTACKER GETS ON YOUR BATTERY  Browsing History  Applications

IF THE ATTACKER GETS ON YOUR BATTERY  Browsing History  Applications  Typing

IF THE ATTACKER GETS ON YOUR BATTERY  Browsing History  Applications  Typing  Photo shot

IF THE ATTACKER GETS ON YOUR BATTERY  Browsing History  Applications  Typing  Photo shot  Communication profile – Phone calls

AGENDA  General scheme for malicious battery attacks  Examples: Keystroke inference Combination of multiple attacks  Data exfiltration mechanism via browser

METHODOLOGY

APP SPECIFIC PIPELINE Activity Novelty Classifier Detector Detector Device Known Classify Active? Event? Ignore Ignore Label App-specific Classifier

BROWSING HISTORY ATTACK PIPELINE Activity Novelty Webpage Detector Detector Classifier Device Known Classify Active? Webpage? Webpage Ignore Ignore Webpage App-specific Classifier

CONSTRAINT - FIT INSIDE THE BATTERY Power requirements - <70 mA phone at rest - Computational complexity - Signal sample rate Storage

KEYSTROKE INFERENCE

KEYSTROKE INFERENCE 000000000000000000000001110110000001110001110011110111000111000000000000000000000000000000000000000000000000000000000000

KEYSTROKE INFERENCE ' C ' Convolutional Neural Network

KEYSTROKE INFERENCE - RESULTS

COMBINATION OF ATTACKS Top 1 – 18% Top 2 – 30% Top 3 – 40% Top 5 – 50%

EXFILTRATION Wifi / Bluetooth Manipulate voltage App Battery Status API

EXFILTRATION Victim

EXFILTRATION Malicious Battery Attacker Victim

SEE PAPER FOR -  Attacks – (Sections 6 & 7)  Web fingerprinting (open-world, Alexa top 100%)  Keystroke  Camera  Incoming calls  Robustness analysis - (Section 8)  Network conditions  Sample rate  Browsers  Phones  Users  Why Power channel leaks data? (Section 10)  Defenses & Mitigation (Section 11)

THEORETICAL?!

QUESTIONS ? Pavel Lifshits, pavell@ef.technion.ac.il Mark Silberstein, mark@ee.technion.ac.il

Power to peep-all: Inference Attacks by Malicious Batteries on - PowerPoint PPT Presentation

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices Pavel Lifshits, Roni Forte , Yedid Hoshen, Matt Halpern, Manuel Philipose, Mohit Tiwari, and Mark Silberstein Speaker: Pavel Lifshits SMART BATTERY

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking Your Secrets Avinash

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

Causal Model Extraction from Attack Trees to Attribute Malicious Insider Attacks Amjad Ibrahim,

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

PEEP recruitment maneuver Step 1 (lung) PEEP Recruits (opens) collapsed alveoli FiO

ChipWhisperer Lite Modeling Power Consumption Every device requires power to run (static Dynamic

Inference attacks on location data S ebastien Gambs Universit e du Qu ebec ` a Montr

I Know Where Youve Been: ! Geo-Inference Attacks via the Browser Cache ! Yaoqi Jia Yaoqi Jia

HOST Differential Power Attacks ECE 525 Side-Channel Attacks Cryptographic algorithms assume

Overview Network and Server Goal of Security Control Attacks and Penetration Phases of

Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media

Keyboards and Covert Channels G. Shah, A. Molina, M. Blaze USENIX 2006 Eric Hennenfent The

No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Everyones a Target Criminals are Always Two Steps Ahead 90% of all cybercrime costs are

Banburismus Banburismus British codebreakers used cribs (guesses), brute force, and the and

Segmentation and Representation for the Reuse of Skills Learned by Imitation 2012. 04. 18.

Empirical Likelihood Upper Confidence Bounds For Bandit Models Olivier Capp e, Aur elien

Nurse Rounding in the Digital World Glynda Summers Executive Director Nursing & Midwifery,

JUSTIN BAEDER An Essential Question How can I tame the tsunami of work that washes over me each

Scrum-Ops Agile Scrum weds Technology Devops Nitin Mudgal RSVP: Gaurav Malhotra Sprints &

Fire Safety in Residential Care Premises Workshop 2 Community Protection Directorate Fire

Providing Science Professional Development for Early Childhood Teachers May 16, 2017

Power to peep-all: Inference Attacks by Malicious Batteries on - PowerPoint PPT Presentation

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices Pavel Lifshits, Roni Forte , Yedid Hoshen, Matt Halpern, Manuel Philipose, Mohit Tiwari, and Mark Silberstein Speaker: Pavel Lifshits SMART BATTERY

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking Your Secrets Avinash

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

Causal Model Extraction from Attack Trees to Attribute Malicious Insider Attacks Amjad Ibrahim,

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

PEEP recruitment maneuver Step 1 (lung) PEEP Recruits (opens) collapsed alveoli FiO

ChipWhisperer Lite Modeling Power Consumption Every device requires power to run (static Dynamic

Inference attacks on location data S ebastien Gambs Universit e du Qu ebec ` a Montr

I Know Where Youve Been: ! Geo-Inference Attacks via the Browser Cache ! Yaoqi Jia Yaoqi Jia

HOST Differential Power Attacks ECE 525 Side-Channel Attacks Cryptographic algorithms assume

Overview Network and Server Goal of Security Control Attacks and Penetration Phases of

Attacks on Clients: Dynamic Content &amp; XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media

Keyboards and Covert Channels G. Shah, A. Molina, M. Blaze USENIX 2006 Eric Hennenfent The

No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Everyones a Target Criminals are Always Two Steps Ahead 90% of all cybercrime costs are

Banburismus Banburismus British codebreakers used cribs (guesses), brute force, and the and

Segmentation and Representation for the Reuse of Skills Learned by Imitation 2012. 04. 18.

Empirical Likelihood Upper Confidence Bounds For Bandit Models Olivier Capp e, Aur elien

Nurse Rounding in the Digital World Glynda Summers Executive Director Nursing &amp; Midwifery,

JUSTIN BAEDER An Essential Question How can I tame the tsunami of work that washes over me each

Scrum-Ops Agile Scrum weds Technology Devops Nitin Mudgal RSVP: Gaurav Malhotra Sprints &amp;

Fire Safety in Residential Care Premises Workshop 2 Community Protection Directorate Fire

Providing Science Professional Development for Early Childhood Teachers May 16, 2017

Attacks on Clients: Dynamic Content & XSS (Section 7.1.3 on JavaScript; 7.2.4 on Media

Nurse Rounding in the Digital World Glynda Summers Executive Director Nursing & Midwifery,

Scrum-Ops Agile Scrum weds Technology Devops Nitin Mudgal RSVP: Gaurav Malhotra Sprints &