“At least six smartcard readers manufactured by five manufacturers sold on Amazon are vulnerable to a direct attack.”
The researchers pulled an ECDSA key off a smartcard reader by filming its power LED with an internet-connected security camera. An iPhone 13 Pro Max’s rolling shutter turns 60 frames a second into 60,000 brightness samples. The LED sits right on the power line with no filtering, so it blinks out whatever the CPU is doing. Vendors skipped the filter and shipped a key leak with a light on it.