Power to peep-all: Inference Attacks by Malicious Batteries on - - PowerPoint PPT Presentation

▶
power to peep all inference attacks by malicious
SMART_READER_LITE
LIVE PREVIEW

Power to peep-all: Inference Attacks by Malicious Batteries on - - PowerPoint PPT Presentation

Nov 25, 2022 337 likes •744 views

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices Pavel Lifshits, Roni Forte , Yedid Hoshen, Matt Halpern, Manuel Philipose, Mohit Tiwari, and Mark Silberstein Speaker: Pavel Lifshits SMART BATTERY

slide-1
SLIDE 1

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices

Pavel Lifshits, Roni Forte , Yedid Hoshen, Matt Halpern, Manuel Philipose, Mohit Tiwari, and Mark Silberstein

Speaker: Pavel Lifshits

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5

SMART BATTERY

  • Programmability
  • Sensors: current, voltage, temperature

Why?  Safety overheating, over/under voltage  Extend battery life  Performance

slide-6
SLIDE 6

SMART BATTERY - PROGRAMMABILITY Software defined battery (SOSP ‘15)

By Microsoft & Tesla

Smart battery System

See spec. http://sbs-forum.org/specs/

slide-7
SLIDE 7

INSIDE SMARTPHONE BATTERY Btemp NFC antenna BSI (battery size/status/system indicator)

slide-8
SLIDE 8

INSIDE SMARTPHONE BATTERY Your phone batteries are getting smarter!

slide-9
SLIDE 9

Do the smart batteries create a new privacy threat?

slide-10
SLIDE 10

Do the smart batteries create a new privacy threat?

slide-11
SLIDE 11

IF THE ATTACKER GETS ON YOUR BATTERY

  • Browsing History
slide-12
SLIDE 12

IF THE ATTACKER GETS ON YOUR BATTERY

  • Browsing History
  • Applications
slide-13
SLIDE 13

IF THE ATTACKER GETS ON YOUR BATTERY

  • Browsing History
  • Applications
  • Typing
slide-14
SLIDE 14

IF THE ATTACKER GETS ON YOUR BATTERY

  • Browsing History
  • Applications
  • Typing
  • Photo shot
slide-15
SLIDE 15

IF THE ATTACKER GETS ON YOUR BATTERY

  • Browsing History
  • Applications
  • Typing
  • Photo shot
  • Communication profile –Phone calls
slide-16
SLIDE 16

AGENDA

  • General scheme for malicious battery attacks
  • Examples:

Keystroke inference Combination of multiple attacks

  • Data exfiltration mechanism via browser
slide-17
SLIDE 17

METHODOLOGY

slide-18
SLIDE 18

METHODOLOGY

slide-19
SLIDE 19

METHODOLOGY

slide-20
SLIDE 20

METHODOLOGY

slide-21
SLIDE 21

App-specific Classifier

Known Event?

Classifier

Label

Novelty Detector

Ignore Classify Device Active?

Activity Detector

Ignore

APP SPECIFIC PIPELINE

slide-22
SLIDE 22

App-specific Classifier

Known Webpage?

Webpage Classifier

Webpage

Novelty Detector

Ignore Classify Webpage Device Active?

Activity Detector

Ignore

BROWSING HISTORY ATTACK PIPELINE

slide-23
SLIDE 23

App-specific Classifier

Known Webpage?

Webpage Classifier

Webpage

Novelty Detector

Ignore Classify Webpage Device Active?

Activity Detector

Ignore

BROWSING HISTORY ATTACK PIPELINE

slide-24
SLIDE 24

CONSTRAINT - FIT INSIDE THE BATTERY

Power requirements - <70 mA phone at rest

  • Computational complexity
  • Signal sample rate

Storage

slide-25
SLIDE 25

CONSTRAINT - FIT INSIDE THE BATTERY

Power requirements - <70 mA phone at rest

  • Computational complexity
  • Signal sample rate

Storage

slide-26
SLIDE 26

KEYSTROKE INFERENCE

slide-27
SLIDE 27

KEYSTROKE INFERENCE

000000000000000000000001110110000001110001110011110111000111000000000000000000000000000000000000000000000000000000000000

slide-28
SLIDE 28

KEYSTROKE INFERENCE 'C'

Convolutional Neural Network

slide-29
SLIDE 29

KEYSTROKE INFERENCE 'C'

Convolutional Neural Network

slide-30
SLIDE 30

KEYSTROKE INFERENCE - RESULTS

slide-31
SLIDE 31

COMBINATION OF ATTACKS Top 1 – 18% Top 2 – 30% Top 3 – 40% Top 5 – 50%

slide-32
SLIDE 32

EXFILTRATION

Wifi / Bluetooth Manipulate voltage

App Battery Status API

slide-33
SLIDE 33

EXFILTRATION

Victim

slide-34
SLIDE 34

EXFILTRATION

Attacker Malicious Battery Victim

slide-35
SLIDE 35

SEE PAPER FOR -

  • Attacks – (Sections 6 & 7)
  • Web fingerprinting (open-world, Alexa top 100%)
  • Keystroke
  • Camera
  • Incoming calls
  • Robustness analysis -

(Section 8)

  • Network conditions
  • Sample rate
  • Browsers
  • Phones
  • Users
  • Why Power channel leaks data? (Section 10)
  • Defenses & Mitigation (Section 11)
slide-36
SLIDE 36

THEORETICAL?!

slide-37
SLIDE 37

THEORETICAL?!

slide-38
SLIDE 38

THEORETICAL?!

slide-39
SLIDE 39

QUESTIONS?

Mark Silberstein, mark@ee.technion.ac.il Pavel Lifshits, pavell@ef.technion.ac.il