0

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security.

I know our bank doesn't allow us to take cell phones in at all, even if they're completely off. If a cell phone can be used to hack a computer like in this article, doesn't that make 2 factor authentication dangerous?

1
  • 8
    "The attack requires both the target computer and mobile phone to have malware installed on them"... "Breakthrough"...
    – Luke Park
    May 1, 2016 at 12:25

1 Answer 1

4

No. The attack-vector described in the article requires the PC to be compromised in some way and requires someone to intercept the radio-traffic sent from your PC.

So first of all: unless your working on some really complex stuff that would be worth spying on it with great effort, you're pretty unlikely to be attacked this way anyways. 2FA via smartphone usually requires you to be online, while the described attack is used for air-gapped machines. Not exactly the setup an every-day user would use. In addition this attack isn't exactly powerful due to the low amount of data that can be transferred, so in general: no sane-minded attacker will ever use this to compromise your machine.

How does the attack even work

The attack, which the developers named GSMem, works by using data-buses as transmitters. There have previously been comparable attacks using video-cards as radio-transmitters, etc.. This kind of attack can be used against air-gapped machines, which obviously can't transfer data via WiFi or any other network. While the video-card type of attack worked via radio-signals and could be received by a smartphones FM-receiver, GSMem uses a different wavelength that can be received via normal base-band chips that are deployed in older phones as well. By using multichannel-buses, the amplitude of the signal can be increased to the point where the receiver can actually read the data. But there are high limitations on this approach even with specific hardware, the connection only had a range of 30m and was restricted to ~1000bit/s. This would be sufficient to steal cryptographic keys, or comparable small data, but won't do for anything larger.

This attack needs two things to work: a compromised machine that you want to intrude. Here the GSMem-malware is deployed to make the PC emit a strong enough signal. And of course a receiver, which would be a phone with a modified baseband-firmware that would function as a receiver. The computer sends the signal to the phone and the phone hands it on to where-ever it is configured to hand it on.

Does that make 2FA useless?

Probably. If someone has access to your PC, he can always just wait for you to authenticate and eavesdrop or modify your actions as long as you're logged in. There's no difference between this and the PC being compromised with any other malware from this POV. But 2FA might keep the bad guy from accessing anything that needs to be authenticated as long as you don't authenticate it on your own.

Does that make 2FA dangerous?

Why should it? As long as your smartphone isn't compromised as well, it at least keeps the bad guy from using services protected by 2FA as long as you don't log in. So in fact it would be an additional layer of security, that would help at least a bit. And if the your smartphone is compromised as well, it just renders 2FA useless. But 2FA won't introduce any new attack-vectors here.

TL;DR

The described attack is - cooked down - spyware that works for air-gapped machines. It won't interfere with 2FA in any different way than usual spyware. In addition it's highly unlikely, that this attack will be used against the average user, due to it's complexity, high limitations and specific intended application.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .