Are nearby attackers dangerous?

Question

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system.

I’m assuming that the word access refers to contact. Sometimes, attackers may not be able to physically contact the machine, but may be able to get close to it.

For example, when I’m taking a bus and put my tablet into my bag, an attacker can get very close to it without acting suspicious, especially when the bus is full of passengers. When I’m using my computer in a (public) library, the guy sitting in front of the next desk may be within 1 meter from my computer.

I’m aware of several attack vectors, but I’m not sure whether there are others I haven’t come up with, and I may underestimate the risk. Those include:

1. Looking at my keyboard input. While I can use other means of authentication (e.g. biometrics), sometimes they are not available (I believe most computers don’t, at least without specialised hardware).

2. Motion sensors that record oscillations. The sensors may eventually gather enough information to crack passwords, etc.

3. Insecure transfer protocol. If there is a bug within the protocol e.g. AirDrop, nearby attackers may exploit that bug and trigger a buffer overflow. Unencrypted transfers like those under http may be read or intercepted by attackers.

I don’t think these are very useful attacks when the attackers cannot get physical access afterwards, and some of them can be easily mitigated (e.g. securely store passwords in browsers, enable 2FA, always use VPN). Not so sure whether there are other things that attackers can do, though. Any help is appreciated.

Answer 1

Overall, you will need to formulate a proper threat model before any question asking for risk analysis can be answered. If you are dealing with highly-sensitive material in an adversarial environment, you may want to only use specially-certified hardware in secure areas. If you are simply trying to avoid identity theft or your Gmail password being revealed, then avoiding shoulder surfing is your priority.

The primary issue with nearby attackers who are not in physical contact with the device is insecure short-range wireless protocols, such as Bluetooth or poorly-secured WiFi. An attacker cannot exploit a wireless chipset or perform a MITM attack against a local wireless network without being relatively close (often within several hundred meters, sometimes less). This issue can be mitigated by using secure wireless protocols and strong passwords.

Another issue which is typically only relevant to sophisticated attackers is that of compromising emanations. Every electrical action performed in a device results in electromagnetic radiation. Depending on the operations, these emanations can be used to reconstruct the operations themselves. This is a problem when processing cryptographic key material. This subject is very broad and is typically put under the realm of EMSEC, or Emission Security. The capabilities of an attacker range from being able to recover keystrokes from a few dozen meters away to being able to recover key material during cryptographic operations. Note that these attacks are not limited to EM radiation. Audio released as capacitors are charged and discharged can give away a surprising amount of information about a system's internal state and ongoing operations.