# Attacks on IoT: Side-Channel Power Acquisition Framework for Intrusion Detection
## 4 Attacks
### Brute Force
#### 4.2.2 Correct-Key Event  
After studying the signature of this attack, it was discovered that there was a unique signature in the event of the correct password being attempted by the tool Hydra. This will be referred to as the Correct-Key Event (CKE) for the remainder of the paper. The opposite case is the Incorrect-Key Event (IKE), where no correct password is found. In fact, in some cases, while watching the data-analyser scope in real-time, it was clear the password had been successfully cracked moments before the tool Hydra informed the attacker of a successful password cracking. This intuition is very similar to how the concepts of simple power analysis (SPA) and differential power analysis (DPA) work [29]. These concepts are both attacks utilising side-channel power analysis approaches to discern if an encryption key has been cracked successfully. In this case, rather than encryption keys being attempted, it is simply a list of passwords being attempted.  
The signature of the CKEs varied negligibly regarding the setting \"t\". In Figure 5, the final attempt for setting \"t1\"--the correct attempt, can be seen milliseconds before the CKE on each board. As the signature occurs far too quickly after the attempt, this suggests that the CKE is not a network-related response but, rather, a cryptographic response from the target system itself, due to the correct password being attempted. Interestingly,  
Figure 4: Incorrect Key Events (IKE) across all Hydra t switches compared for DragonBoard and Raspberry Pi (data represented using the “autumn” colormap [46]).  
regardless of the Hydra settings used, each board's CKE signature remains the same. To our knowledge, this is the first time this specific event has been documented.  
The impact of the CKE is enormous. For a forensics team, being able to tell precisely when the password was cracked, when responding to a breach, is very valuable. This can allow a forensics team to create a more detailed and accurate report on what happened during the attack, leaving much less time unaccounted for and assisting in countermeasures against future breaches. For instance, if a team sees that the attacker cracked the password very quickly, it would suggest that a weak password was used. This could direct teams to change policies in the organisation to improve security.  
An attacker who wishes to hide their attacks can tell Hydra to continue to the end of the password file even after the correct key is found. They may do this to mislead the forensics team, giving the attacker hours, while the forensic team thinks the attack ended when the large IKE signatures stopped. However, if a forensics team attempted to crack their password and look at the CKE signature, they would be able to match the signature with their logged data to ascertain exactly, within milliseconds, when the password was cracked. This is one way in which security and forensics teams can reverse engineer the events that occurred to the victim to better understand what happened during a breach.  
Figure 5: Correct Key Events (CKE) across all Hydra t switches compared for DragonBoard and Raspberry Pi (data represented using the “autumn” colormap [46]).