CAPEC-625: Mobile Device Fault Injection
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.
所需技能
后果影响
影响范围: Confidentiality Access Control
技术影响: Read Data
说明: Extract long-term secret keys (e.g. keys used for VPN or WiFi authentication and encryption) to enable decryption of intercepted VOIP traffic.
缓解措施
Strong physical security of all devices that contain secret key information. (even when devices are not in use)
Frequent changes to secret keys and certificates.