Princeton student devises new smart card attack

CNET reports on a new attack on certain types of smart cards developed by a Princeton student.

The attack requires physical access to the computer, so the technique poses little threat to virtual machines running on PCs and servers. But it could be used to steal data from smart cards, said Sudhakar Govindavajhala, a computer-science graduate student at Princeton who demonstrated the procedure Tuesday. "There are smart cards that use Java that you could shine a light on, flip a bit and get access to the card's data," he said. The technique relies on the ability of energy to "flip bits" in memory. While cosmic rays can very occasionally cause a random bit in memory to change value, from 0 to 1 or from 1 to 0, Govindavajhala decided not to wait. He used a lamp to heat up the chips inside a computer and cause one or more bits of memory to change. By doing so, the researcher broke the security model that virtual machine's rely on--that the computer faithfully executes its instruction set.