SCANDALee: A side-ChANnel-based DisAssembLer using local electromagnetic emanations

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Authors

  • Daehyun Strobel
  • Florian Bache
  • David Oswald
  • Falk Schellenberg
  • Christof Paar

Colleges, School and Institutes

External organisations

  • Universitat Bochum

Abstract

Side-channel analysis has become a well-established topic in the scientific community and industry over the last one and a half decade. Somewhat surprisingly, the vast majority of work on side-channel analysis has been restricted to the 'use case' of attacking cryptographic implementations through the recovery of keys. In this contribution, we show how side-channel analysis can be used for extracting code from embedded systems based on a CPU's electromagnetic emanation. There are many applications within and outside the security community where this is desirable. In cryptography, it can, e.g., be used for recovering proprietary ciphers and security protocols. Another broad application field is general security and reverse engineering, e.g., for detecting IP violations of firmware or for debugging embedded systems when there is no debug interface or it is proprietary. A core feature of our approach is that we take localized electromagnetic measurements that are spatially distributed over the IC being analyzed. Given these multiple inputs, we model code extraction as a classification problem that we solve with supervised learning algorithms. We apply a variant of linear discriminant analysis to distinguish between the multiple classes. In contrast to previous approaches, which reported instruction recognition rates between 40-70%, our approach detects more than 95% of all instructions for test code, and close to 90% for real-world code. The methods are thus very relevant for use in practice. Our method performs dynamic code recognition, which has both advantages (only the program parts that are actually executed are observed) but also limitations (rare code executions are difficult to observe).

Details

Original languageEnglish
Title of host publication2015 Design, Automation and Test in Europe Conference & Exhibition (DATE), proceedings
Publication statusPublished - 23 Apr 2015
Event2015 Design, Automation and Test in Europe Conference and Exhibition, DATE 2015 - Grenoble, France
Duration: 9 Mar 201513 Mar 2015

Conference

Conference2015 Design, Automation and Test in Europe Conference and Exhibition, DATE 2015
CountryFrance
CityGrenoble
Period9/03/1513/03/15

ASJC Scopus subject areas