Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices

Abstract

Internet of Things (IoT) devices have expanded the horizon of digital forensic investigations by providing a rich set of new evidence sources. IoT devices includes health implants, sports wearables, smart burglary alarms, smart thermostats, smart electrical appliances, and many more. Digital evidence from these IoT devices is often extracted from third party sources, e.g., paired smartphone applications or the devices' back-end cloud services. However vital digital evidence can still reside solely on the IoT device itself. The specifics of the IoT device's hardware is a black-box in many cases due to the lack of proven, established techniques to inspect IoT devices. This paper presents a novel methodology to inspect the internal software activities of IoT devices through their electromagnetic radiation emissions during live device investigation. When a running IoT device is identified at a crime scene, forensically important software activities can be revealed through an electromagnetic side-channel analysis (EM-SCA) attack. By using two representative IoT hardware platforms, this work demonstrates that cryptographic algorithms running on high-end IoT devices can be detected with over 82% accuracy, while minor software code differences in low-end IoT devices could be detected over 90% accuracy using a neural network-based classifier. Furthermore, it was experimentally demonstrated that malicious modification of the stock firmware of an IoT device can be detected through machine learning-assisted EM-SCA techniques. These techniques provide a new investigative vector for digital forensic investigators to inspect IoT devices.

A Survey of Security Challenges, Attacks Taxonomy and Advanced Countermeasures in the Internet of Things

“…The Knownplaintext attack, Ciphertext-only attack and Chosenplaintext attack are some of the other examples of cryptanalysis attacks [123].  Side-Channel Information Attacks: During the process of the encryption operation, the attacker obtains information and performs a reverse-engineering process to gather the cryptographic credentials of an IoT device [124], [125]. This information can be gained from the encryption devices, not from plaintext or ciphertext during the encryption process.…”

“…Both results confirm that the accuracy rate of authentication of the method achieves 84% without requiring manual labeling. The authors in [125] proposed a learning-based algorithm to detect sidechannel attacks and showed 82% and 90% detection accuracy on high-end and low-end IoT devices, respectively.…”

Task Parameters Analysis in Schedule-Based Timing Side-Channel Attack

“…Side-channels and covert-channels have been well studied in many research domains. Typical side-channels such as cache access time [26], power consumption traces [27], electromagnetic emanations [25], temperature [28], etc., may also be seen against real-time system (RTS). In this paper, we focus on scheduler-based channels.…”

“…Note that, 25MHz here corresponds to the main frequency of MSP430 MCU, while 50MHz is its harmonic. Therefore, it is easy to develop classification algorithms (e.g., neural network-based [25]) to automatically distinguish them, then constructing execution sequences.…”

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

“…Due to the non-invasive nature of EM-SCA, it has been proposed to be used as a forensic insight-gathering method. Various types of forensic insights have been demonstrated to be acquirable from IoT devices in the literature [7], [8]. This work explores the potential of utilising EM radiation of smartphones as a method to acquire forensic insights from them during triage examination and live analysis of an investigation.…”