When people hear the word cyberattack, they usually imagine someone guessing a password, planting malware, stealing a computer, hacking an organization’s network or exploiting a flaw in software. A side-channel attack works differently. It looks for clues a computer gives away while doing ordinary work.

A simple analogy is a locked safe. A thief may not know the combination and may not be able to break the lock. But if the thief can listen closely as the dial turns, small clicks or churns or pauses might reveal something about what is happening inside. The safe is not meant to share that information, but its physical behavior still leaks clues.

Modern computers have their own versions of such clues. For example, each computer might take different amounts of time to complete different tasks or may use different amounts of electricity. The hardware – processors, memory, graphics cards and storage drives – may leave tiny patterns as they work.

I’m a computer scientist who studies security and privacy. I define a side-channel attack as an attempt to observe these indirect clues and use them to infer something private.

This is what makes these side-channel attacks unusual. The weakness comes from the way a machine performs its work. The attacker does not steal a password directly or break into the computer, but instead studies the traces left behind by the machine while it is operating.

The idea is not new. In 1985, Dutch researcher Wim van Eck showed that electromagnetic signals from video display units could be captured and decoded, raising the possibility of eavesdropping on what a screen displayed. The screen was not intentionally broadcasting its contents. It was leaking signals as a side effect of operating.

In the 1990s, side-channel attacks........

© The Conversation