research-article

Thermal covert channel in bluetooth low energy networks

Authors:

Timothy Claeys,

Franck Rousseau,

Boris Simunovic, and

Bernard TourancheauAuthors Info & Claims

WiSec '19: Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks

May 2019

Pages 267 - 276

https://doi.org/10.1145/3317549.3319730

Published: 15 May 2019 Publication History

Abstract

This paper investigates thermal covert channels in the context of the Internet-of-Things. More, precisely we demonstrate such a channel on BLE-enabled devices. We explain how the core design principles of BLE link-layer protocol, combined with well-timed intensive CPU calculations can be leveraged to mount a thermal covert channel between two devices.

We implement the attack on three different hardware architectures, a Raspberry Pi 3B, a Motorola X 2014 and an iPhone 5s, and analyze the performance of the channel. We show that we have a similar throughput as previous comparable work, but we greatly improve the range of the channel.

References

[1]

2012. IEEE 802.15.4e Low-Rate Wireless Personal Area Networks (Amendment to IEEE Std 802.15.4-2011). IEEE Standards Office, New York, NY, USA.

[2]

Bluetooth SIG 2010. Bluetooth Core specification 4.0. Bluetooth SIG.

[3]

Bluetooth SIG 2016. Bluetooth Core specification 5.0. Bluetooth SIG.

[4]

Raj Chandra Bose and Dwijendra K Ray-Chaudhuri. 1960. On A Class of Error Correcting Binary Group Codes. Information and control 3, 1 (1960), 68--79.

[5]

Cypress Semiconductor Corporation 2016. BCM4334: Single Chip IEEE 802.11 a/b/g/n MAC/Baseband/Radio with Integrated Bluetooth 4.0 + HS and FM Receiver. Cypress Semiconductor Corporation. http://www.rumjd.com/Attachments/20160820160827_152216_171.pdf

[6]

Cypress Semiconductor Corporation 2018. CYW43438: Single-Chip IEEE 802.11 b/g/n MAC/Baseband/Radio with Integrated Bluetooth 4.2. Cypress Semiconductor Corporation.

[7]

Atis Elsts, Simon Duquennoy, Xenofon Fafoutis, George Oikonomou, Robert Piechocki, and Ian Craddock. 2016. Microsecond-Accuracy Time Synchronization Using the IEEE 802.15.4 TSCH Protocol. In IEEE SenseApp 2016-Eleventh IEEE International Workshop on Practical Issues in Building Sensor Network Applications.

[8]

Fluke 2003. 175, 177, 179 True-rms Multimeters: User manual. Fluke. https://www.instrumart.com/assets/179-manual.pdf

[9]

Raspberry Pi Foundation. 2016. Raspberry Pi 3B. https://www.raspberrypi.org/products/raspberry-pi-3-model-b/

[10]

Great Scott Gadgets. 2018. Project Ubertooth. https://github.com/greatscottgadgets/ubertooth/

[11]

Carles Gomez, Joaquim Oller, and Josep Paradells. 2012. Overview and Evaluation of Bluetooth Low Energy: An Emerging Low-Power Wireless Technology. Sensors 12, 9 (2012), 11734--11753.

[12]

Mordechai Guri, Matan Monitz, Yisroel Mirski, and Yuval Elovici. 2015. BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations. In 28th IEEE Computer Security Foundations Symposium (CSF). 276--289.

Digital Library

[13]

Gareth Halfacree. {n. d.}. Benchmarking the Raspberry Pi 3 B+. https://medium.com/@ghalfacree/benchmarking-the-raspberry-pi-3-b-plus-44122cf3d806

[14]

IFIXIT. {n. d.}. iPhone 5s Teardown. https://nl.ifixit.com/Teardown/iPhone+5s+Teardown/17383

[15]

IFIXIT. {n. d.}. Motorola Moto X Teardown. https://nl.ifixit.com/Teardown/Motorola+Moto+X+Teardown/16867

[16]

APPLE IFIXIT. 2013. The Teardown: Apple iPhone 5s. 8 (November 2013). Issue 10.

[17]

Ramya Jayaram Masti, Devendra Rai, Aanjhan Ranganathan, Christian Müller, Lothar Thiele, and Srdjan Capkun. 2015. Thermal Covert Channels on Multi-core Platforms. In USENIX Security Symposium. 865--880.

Digital Library

[18]

Elodie Morin, Mickael Maman, Roberto Guizzetti, and Andrzej Duda. 2017. Comparison of the Device Lifetime in Wireless Networks for the Internet of Things. IEEE Access 5 (2017), 7097--7114.

[19]

Steven J. Murdoch. 2006. Hot or Not: Revealing Hidden Services by their Clock Skew. In 13th ACM conference on Computer and communications security. ACM, 27--36.

Digital Library

[20]

Lily Hay Newman. 2018. Inside the Unnerving Supply Chain Attack that Corrupted CCleaner. https://www.wired.com/story/inside-the-unnerving-supply-chain-attack-that-corrupted-ccleaner/

[21]

NXP Semiconductors 2015. LPC1759/58/56/54/52/51:32-bit ARM Cortex-M3 MCU; up to 512 kB flash and 64 kB SRAM with Ethernet, USB 2.0 Host/Device/OTG, CAN. NXP Semiconductors. https://www.nxp.com/docs/en/data-sheet/LPC1759_58_56_54_52_51.pdf

[22]

Qualcomm Technologies, Inc 2014. Qualcomm Snapdragon 801 Processor. Qualcomm Technologies, Inc. https://www.qualcomm.com/media/documents/files/snapdragon-801-processor-product-brief.pdf

[23]

Qualcomm Technologies, Inc 2017. WCN3680B/WCN3660B: device specification. Qualcomm Technologies, Inc. https://developer.qualcomm.com/download/sd410/wcn3680b-wcn3660b-device-spec.pdf

[24]

Magic Blue UU. {n. d.}. Bluetooth Bulb. https://www.gearbest.com/smart-light-bulb/pp_230349.html

[25]

Royyan Wijaya, Viktor Vorobyev, and Sandra. 2017. The Noun Project - Icons for Everything. https://thenounproject.com/

Cited By

Amro OMishra VNegi RChatterjee U(2023)CPU-Doctor: when a device’s heart-beat can be an acoustic side-channel disassemblerJournal of Cryptographic Engineering10.1007/s13389-023-00327-zOnline publication date: 6-Jul-2023
https://doi.org/10.1007/s13389-023-00327-z
Dhananjay KPavlidis VCoskun ASalman E(2022)High Bandwidth Thermal Covert Channel in 3-D-Integrated Multicore ProcessorsIEEE Transactions on Very Large Scale Integration (VLSI) Systems10.1109/TVLSI.2022.320343030:11(1654-1667)Online publication date: Nov-2022
https://doi.org/10.1109/TVLSI.2022.3203430
Kim TShin Y(2022)ThermalBleed: A Practical Thermal Side-Channel AttackIEEE Access10.1109/ACCESS.2022.315659610(25718-25731)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2022.3156596
Show More Cited By

Index Terms

Thermal covert channel in bluetooth low energy networks
1. Security and privacy
  1. Network security
    1. Mobile and wireless security

Recommendations

Adaptive ternary timing covert channel in IEEE 802.11

Covert channel is one of the most interesting topics in the computer networks security. Covert channel designers are seeking to discover weaknesses in the communications algorithms to use them as the medium for covert transmission. Broadcast nature of ...
Read More
An 802.11 MAC layer covert channel

For extremely sensitive applications, it may be advantageous for users to transmit certain types of data covertly over the network. This provides an additional layer of security to that provided by the different layers of the protocol stack. In this ...
Read More
Out-of-Band Covert Channels—A Survey

A novel class of covert channel, out-of-band covert channels, is presented by extending Simmons’ prisoners’ problem. This new class of covert channel is established by surveying the existing covert channel, device-pairing, and side-channel research. ...
Read More

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

WiSec '19: Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks

May 2019

359 pages

ISBN:9781450367264

DOI:10.1145/3317549

Copyright © 2019 ACM.

© 2019 Association for Computing Machinery. ACM acknowledges that this contribution was authored or co-authored by an employee, contractor or affiliate of a national government. As such, the Government retains a nonexclusive, royalty-free right to publish or reproduce this article, or to allow others to do so, for Government purposes only.

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

In-Cooperation

SIGMOBILE: ACM Special Interest Group on Mobility of Systems, Users, Data and Computing

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 15 May 2019

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Investissement d'Avenir
Region Auvergne-Rhone-Alpes

Conference

WiSec '19

Sponsor:

SIGSAC

WiSec '19: 12th ACM Conference on Security and Privacy in Wireless and Mobile Networks

May 15 - 17, 2019

Florida, Miami

Acceptance Rates

Overall Acceptance Rate 98 of 338 submissions, 29%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

4
Total Citations
View Citations
236
Total Downloads

Downloads (Last 12 months)16
Downloads (Last 6 weeks)3

Other Metrics

View Author Metrics

Citations

Cited By

Amro OMishra VNegi RChatterjee U(2023)CPU-Doctor: when a device’s heart-beat can be an acoustic side-channel disassemblerJournal of Cryptographic Engineering10.1007/s13389-023-00327-zOnline publication date: 6-Jul-2023
https://doi.org/10.1007/s13389-023-00327-z
Dhananjay KPavlidis VCoskun ASalman E(2022)High Bandwidth Thermal Covert Channel in 3-D-Integrated Multicore ProcessorsIEEE Transactions on Very Large Scale Integration (VLSI) Systems10.1109/TVLSI.2022.320343030:11(1654-1667)Online publication date: Nov-2022
https://doi.org/10.1109/TVLSI.2022.3203430
Kim TShin Y(2022)ThermalBleed: A Practical Thermal Side-Channel AttackIEEE Access10.1109/ACCESS.2022.315659610(25718-25731)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2022.3156596
Vogel DAkhmedjanov UOhm MMeier MVolkamer MWressnegger C(2020)An investigation on the feasibility of the bluetooth frequency hopping mechanism for the use as a covert channel techniqueProceedings of the 15th International Conference on Availability, Reliability and Security10.1145/3407023.3409218(1-10)Online publication date: 25-Aug-2020
https://dl.acm.org/doi/10.1145/3407023.3409218

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents