Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know about Multi-Factor Authentication is applicable for TEMPEST or not. Why I'm asking is I have suspicious matter every day also captured as log.

My concern:

It's possible to steal my account, password from my display or my keyboard tapping and also pass code for MFA from Smartphone such Google Authenticator. So, They can get in my account faster than me if they could use supercomputer to grab and put them.

Question:

  1. How can I protect my account against TEMPEST and side channel attack when to authenticate between Google. Is there an alternative way to protect?

Maybe, I should know about TEMPEST more what it can do related to IT. and will ask side channel attack after investigating.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

TEMPEST uses techniques like electromagnetic signals, vibrations and sounds that the target does not expect to be interceptable or interpretable to spy on the target's system.

Using multi-factor authentication would only be able to constrain TEMPEST-like attacks on local or single-factor authentication, and be potentially useless for protecting against attacks on transport-level encryption, session hijacking, HMAC generation and so on. (See the attack class documented here http://www.cs.tau.ac.il/~tromer/acoustic/)

Compromise of multi-factor, partially-remote authentication is possible if the communication channels have been successfully compromised to your smartphone. I'd have to argue that that's a lot of work and there are probably significantly easier ways to permanently compromise your system.

share|improve this answer
    
Thank you for your answer. It helped me! –  user3171796 Feb 26 at 11:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.