  Screaming-channel attacks enable Electromagnetic (EM) Side-Channel Attacks
(SCAs) at larger distances due to higher EM leakage energies than traditional
SCAs, relaxing the requirement of close access to the victim. This attack can
be mounted on devices integrating Radio Frequency (RF) modules on the same die
as digital circuits, where the RF can unintentionally capture, modulate,
amplify, and transmit the leakage along with legitimate signals. Leakage
results from digital switching activity, so the hypothesis of previous works
was that this leakage would appear at multiples of the digital clock frequency,
i.e., harmonics. This work demonstrates that compromising signals appear not
only at the harmonics and that leakage at non-harmonics can be exploited for
successful attacks. Indeed, the transformations undergone by the leaked signal
are complex due to propagation effects through the substrate and power and
ground planes, so the leakage also appears at other frequencies. We first
propose two methodologies to locate frequencies that contain leakage and
demonstrate that it appears at non-harmonic frequencies. Then, our experimental
results show that screaming-channel attacks at non-harmonic frequencies can be
as successful as at harmonics when retrieving a 16-byte AES key. As the RF
spectrum is polluted by interfering signals, we run experiments and show
successful attacks in a more realistic, noisy environment where harmonic
frequencies are contaminated by multi-path fading and interference. These
attacks at non-harmonic frequencies increase the attack surface by providing
attackers with an increased number of potential frequencies where attacks can
succeed.
