CVE-2019-14358 : Security Advisory and Response

Researchers discovered a side channel vulnerability in the row-based OLED display of Archos Safe-T devices, allowing the partial recovery of display contents through power consumption analysis. This vulnerability poses a risk when sensitive information like PIN and BIP39 mnemonic is displayed.

Understanding CVE-2019-14358

This CVE identifies a side channel vulnerability in the row-based OLED display of Archos Safe-T devices.

What is CVE-2019-14358?

The vulnerability enables attackers to recover display contents by analyzing power consumption during display cycles, particularly when sensitive information is shown.

The Impact of CVE-2019-14358

Attackers can potentially retrieve confidential secrets like PIN and BIP39 mnemonic by exploiting this vulnerability.
The side channel is only relevant when the attacker can measure power consumption during the display of secret data.

Technical Details of CVE-2019-14358

This section provides technical insights into the vulnerability.

Vulnerability Description

The power consumption of each row-based display cycle on Archos Safe-T devices depends on the number of illuminated pixels, allowing partial recovery of display contents.

Affected Systems and Versions

Product: Archos Safe-T devices
Vendor: N/A
Versions: N/A

Exploitation Mechanism

Attackers with control over the USB connection can exploit the vulnerability by implanting a hardware device in the USB cable.
By measuring power consumption when sensitive information is displayed, attackers can potentially retrieve confidential secrets.

Mitigation and Prevention

Protecting against CVE-2019-14358 involves taking immediate steps and implementing long-term security practices.

Immediate Steps to Take

Avoid connecting unknown or untrusted USB devices to Archos Safe-T devices.
Regularly monitor power consumption during display cycles for unusual patterns.

Long-Term Security Practices

Implement device isolation techniques to prevent unauthorized access to USB connections.
Conduct regular security audits to detect and mitigate potential vulnerabilities.

Patching and Updates

Stay informed about security updates from Archos for the Safe-T devices.
Apply patches promptly to address any known vulnerabilities.