论文标题
在物联网设备中滥用商品DRAM，以远程监视温度
Abusing Commodity DRAMs in IoT Devices to Remotely Spy on Temperature
论文作者
论文摘要
现代物联网（IoT）设备的无处不在和普遍性为新型应用程序打开了巨大的可能性，但同时还允许从以前看不见的程度上监视和收集毫无戒心的用户的数据。本文详细介绍了一种新的攻击形式，其中利用了广泛的，现成的DRAM模块的衰减特性，以准确地感知持续式装置设备附近的温度。除其他外，这使对手能够远程和纯粹的数字监视用户私人住宅中的个人行为，或者在服务器农场，云存储中心或商业生产线中收集关键的安全数据。我们证明可以通过仅损害物联网设备的软件，并且不需要在攻击时进行硬件修改或物理访问来执行攻击。实际上，它可以在0°C至70°C的范围内实现高达0.5°C的温度分辨率。也许最有趣的是，它甚至可以在没有专用温度传感器的设备中使用。为了完成我们的工作，我们讨论了实用的攻击场景，并可能针对我们的温度间谍活动攻击进行对策。
The ubiquity and pervasiveness of modern Internet of Things (IoT) devices opens up vast possibilities for novel applications, but simultaneously also allows spying on, and collecting data from, unsuspecting users to a previously unseen extent. This paper details a new attack form in this vein, in which the decay properties of widespread, off-the-shelf DRAM modules are exploited to accurately sense the temperature in the vicinity of the DRAM-carrying device. Among others, this enables adversaries to remotely and purely digitally spy on personal behavior in users' private homes, or to collect security-critical data in server farms, cloud storage centers, or commercial production lines. We demonstrate that our attack can be performed by merely compromising the software of an IoT device and does not require hardware modifications or physical access at attack time. It can achieve temperature resolutions of up to 0.5°C over a range of 0°C to 70°C in practice. Perhaps most interestingly, it even works in devices that do not have a dedicated temperature sensor on board. To complete our work, we discuss practical attack scenarios as well as possible countermeasures against our temperature espionage attacks.
