Rubbish Claim - Data leak through power line by throttling CPU cores.

[Bassman59]

This has been known about for years in certain sectors. There were massive banks of “power filters” in a facility I was in once which were supposedly to stop information leaking. They were also worried about CRT emissions at the time so CRTs were only allowed in rooms with no windows and shielded lined walls.

At my first job after college, for some reason my group bought a TEMPEST-compliant PC (with associated keyboard and display). It was an absurdly-expensive 80286 machine.

[bugi]

@Vendicar Decarian

I'm no expert, but judging from your comment, you might know even less, so just some points out of my memory, about PC PSUs (and a bit of motherboard). My apologies if I'm just stating what you already know.

* The motherboard caps, inductors and related circuits are designed to keep the voltages for the CPU well regulated; they are not designed to hide load (current) change from the PSU. The caps' task is to keep the voltage steady, and have pretty much no say about the current. The inductors' typical job is to just filter the high frequency switching currents (typically at least 60kHz, but I think I've seen 1MHz+). The circuitry does not do much about hiding the <1kHz changes; it only needs to hold things steady long enough that the PSU has time to react. Anything longer is wasted money (and PCB area).

* The PSU main "filter"/smoothing caps, their task is to keep the rest of the circuitry happy enough that the PC keeps running. Their task is not to filter out noise (or data signals). Thus, they are optimized for doing that voltage leveling/energy storage task "good enough" at the cheapest price, and filtering noise is just a side-effect. They do not keep the voltage 100% constant, not even close. Any load change applied to them will change the dV/dt, which in turn is seen as input voltage/current/power change after PFC has had its work done (as it tries to keep both the main cap voltage and line loading in check). Which change in turn can be seen at varying level past the EMI filters.

* The EMI filters would attenuate noise/data. But not at low frequencies; their main interest is to attenuate (note, not 100% removal) the typically >60kHz switching noise, and to let the 50-60Hz AC get through. Again, attenuation is done "just enough" to satisfy both the regulators and company profits (i.e. barely within requirements). How the attenuation varies in the 3-4 decades of frequencies in between can affect how much bandwidth would be available for noise/data.

* The main transformer does not need to hold as much energy as the main filter cap(s), due to >1000x higher frequency on the transformer.

* The secondary side capacitors are designed to smooth out all types of changes in voltage or load, but within their limits. Especially, lower frequency load changes will slip right through them. They are typically designed to smooth things out just long enough that the PWM controller and other circuitry has time to catch up, which typically doesn't take that many switching cycles. The control loop will transfer those slower changes to primary side, too.

* Various noises (or data in this case) through the PSU can happen in different ways at different frequencies (bit rates). Low enough can be seen as slow change in load current, medium frequencies might come through as voltage and/or current noise (EMI filters not being very good at lower frequencies, noises/data perhaps coupling in various ways all the way from the secondary side).

There is of course lots of smaller effects and details (attenuations, different means for noise/data to move through the circuits), but I won't even try to get into those. And there are of course PSUs and motherboards that are better in the filtering and/or keeping voltages steadier than a "typical" version.

I didn't read that paper. I've read enough many similar papers before, using even more exotic methods, and can also draw info from other contexts, that I've come to understand that if there is a parameter that is not fully isolated, and that parameter can be affected, it can be used to transmit data. Only the maximum rate and how far the data can be transmitted varies.

[Mr. Scram]

Yes, I've read the paper. I think the "line level" attack is not too relevant in practice, since you need to place your current sensor physically quite close to the computer. The "phase level" detection can be done from a more realistic distance.

In the conclusion, the authors neglect to mention the 4% bit error rate they showed earlier in the paper for phase sensing at 10 bit/s. Hence the usable data rate will be a bit lower.

So you don't consider it a rubbish claim, just of limited application in the real world.

[ebastler]

Yes, I've read the paper. I think the "line level" attack is not too relevant in practice, since you need to place your current sensor physically quite close to the computer. The "phase level" detection can be done from a more realistic distance.

In the conclusion, the authors neglect to mention the 4% bit error rate they showed earlier in the paper for phase sensing at 10 bit/s. Hence the usable data rate will be a bit lower.

So you don't consider it a rubbish claim, just of limited application in the real world.

Right. I think that the claims in the publication are plausible (and they are supported by measurements), so they are certainly not "rubbish claims". There are constraints which limit the use in the real world -- most notably the attacker needing access to the power line not too far from the attacked computers, and the limited data rate even under favorable conditions. But those constraints are correctly described in the paper.