Computers can leak secrets without being hacked. This method, known as a side-channel attack, doesn’t rely on stolen passwords or malware. Instead, it exploits the physical traces a machine leaves behind while performing routine tasks—tiny clues that reveal sensitive information.
The safe that talks
A locked safe won’t give up its combination, but a thief listening closely might hear faint clicks or pauses as the dial turns. Those sounds aren’t meant to share information, yet they can expose what’s happening inside. Computers behave similarly. Their hardware—processors, memory, storage—leaves subtle patterns as they operate: variations in time, power consumption, or electromagnetic signals.
The vulnerability isn’t in the software or encryption but in how the machine executes its tasks. The attacker doesn’t break in—they monitor the machine’s behavior.
Related: Efficiency Upgrade Backfires, Making Tasks More Difficult
Decades of unintended leaks
The concept isn’t new. In 1985, Dutch researcher Wim van Eck demonstrated that electromagnetic signals from computer monitors could be captured and decoded. This allowed eavesdroppers to reconstruct what appeared on the screen. The monitor wasn’t designed to broadcast its contents, but it leaked them anyway.
By the 1990s, these attacks became a serious concern in cryptography. In 1996, Paul Kocher showed that measuring how long certain operations took could expose private keys in systems using common encryption methods. A few years later, Kocher and colleagues Joshua Jaffe and Benjamin Jun proved that tracking power consumption could extract secret keys from tamper-resistant devices like smart cards.
These findings forced engineers to reconsider security. Strong encryption alone wasn’t sufficient. They had to account for whether the hardware might leak hints through timing, power, or other physical behaviors.
How the clues add up
Side-channel attacks take several forms. Timing attacks exploit small differences in how long operations take. Power attacks analyze electricity use. Electromagnetic attacks intercept unintended signals. In one experiment, researchers showed that the faint noise a laptop made during cryptographic operations could, under controlled conditions, reveal a 4,096-bit encryption key.
Related: Apple to launch iPhone 8 and 8 Plus in India on September 29
The most high-profile examples involved modern processors. CPUs use speculative execution—a technique that predicts what a program will do next—to improve performance. But in 2018, researchers uncovered two vulnerabilities, Meltdown and Spectre, that exploited this feature. The attacks demonstrated that these predictions left measurable traces, allowing malicious programs to access data they shouldn’t see. The flaws challenged a core assumption of computing: that different programs running on the same machine remain isolated.
The SSD that listens
The latest attack, FROST, targets solid-state drives, the fast storage used in most modern computers. It uses a browser feature called the origin private file system—a protected area where websites store data. By creating files in this sandbox and measuring tiny delays in SSD activity, a malicious website can infer details about other programs running on the same machine, such as which websites a user has visited or which applications are open.
The logic is simple: when multiple programs access the same storage device, they can slow each other down slightly. Measuring those delays can reveal patterns in what else is happening on the computer.
These attacks don’t require direct access. In some cases, a website or background software can gather clues without the user noticing. The traces are often too faint for humans to detect, but precise measurements can turn them into valuable intelligence.
Related: Leonardo and European Defence Modernisation: Long-Term Catalysts for Aerospace and Security Stocks
Most cybercrime still relies on simpler methods, like exploiting software flaws or stealing credentials. A 2026 report highlighted software vulnerabilities and ransomware as the leading causes of breaches, not side-channel attacks.
That doesn’t make these attacks unimportant. Many are discovered by researchers before criminals exploit them. Their real impact lies in exposing fundamental weaknesses in computer design. They’ve influenced chip architecture, browser security, and cloud computing. The attacks force a shift in thinking: security isn’t just about locking down data—it’s about controlling how machines behave while processing it.
Computers don’t need to intentionally reveal secrets to leak them. Sometimes, the smallest operational clues say more than intended.
