Uncovering Software-Based Power Side-Channel Attacks on Apple M1/M2 Systems

• URL: http://arxiv.org/abs/2306.16391v2
• Date: Fri, 04 Oct 2024 22:19:12 GMT
• Title: Uncovering Software-Based Power Side-Channel Attacks on Apple M1/M2 Systems
• Abstract summary: Research has shown that on-chip power meter capabilities exposed to a software interface might be used for power side-channel attacks without physical access. We show that such software-based power side-channel attack is also applicable on Apple silicon.
• Score: 5.309199271673022
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Traditionally, power side-channel analysis requires physical access to the target device, as well as specialized devices to measure the power consumption with enough precision. Recently research has shown that on x86 platforms, on-chip power meter capabilities exposed to a software interface might be used for power side-channel attacks without physical access. In this paper, we show that such software-based power side-channel attack is also applicable on Apple silicon (e.g., M1/M2 platforms), exploiting the System Management Controller (SMC) and its power-related keys, which provides access to the on-chip power meters through a software interface to user space software. We observed data-dependent power consumption reporting from such SMC keys and analyzed the correlations between the power consumption and the processed data. Our work also demonstrated how an unprivileged user mode application successfully recovers bytes from an AES encryption key from a cryptographic service supported by a kernel mode driver in MacOS. We have also studied the feasibility of performing frequency throttling side-channel attack on Apple silicon. Furthermore, we discuss the impact of software-based power side-channels in the industry, possible countermeasures, and the overall implications of software interfaces for modern on-chip power management systems.

Related papers

• Profiling-Driven Adaptive Distributed Transformer Inference on Embedded Edge Deployment [60.442064966340524]
  We present a prototype study on NVIDIA Jetson Orin Nano devices connected over WiFi.<n>Key finding is that the dominant bottleneck is not just network bandwidth but also the CPU- GPU staging during communication.<n>Experiments show that this strategy reduces latency by 65%-77% and energy consumption by 34%-52% relative to full-tensor exchange.
  arXiv  Detail & Related papers  (2026-05-25T10:39:28Z)
• A UEFI System with SPDM to Protect Against Unauthorized Device Connections [0.0]
  We propose a system capable of authenticating PCIe and USB devices trying to connect with it.<n>We develop an open source proof-of-concept using emulation to evaluate and illustrate our proposal.<n>During firmware execution, the number of instructions and the number of CPU cycles increased respectively 13% and 8% on average.
  arXiv  Detail & Related papers  (2026-05-07T14:40:26Z)
• Software-Hardware Binding for Protection of Sensitive Data in Embedded Software [0.0]
  We present a novel protection mechanism that combines hardware fingerprints with Boolean logic.<n>Unlike usual copy-protection approaches, unauthorised copies of the software still run on cloned devices but suboptimally.<n>Our approach does not require additional hardware, relying only on relatively simple updates to the software.
  arXiv  Detail & Related papers  (2026-03-12T09:33:42Z)
• Boosting Device Utilization in Control Flow Auditing [47.36491265793223]
  Control Flow (CFAud) is a mechanism wherein a remote verifier (Vrf) is guaranteed to received evidence about the control flow path taken on a prover (Prv) MCU, even when Prv software is compromised.<n>Current CFAud requires a busy-wait'' phase where root-of-anchored root-of-RoT in Prv retains execution to ensure delivery of flow evidence to Vrf.<n>CARAMEL is a hardware RoT co-design that enables Prv to resume while control flow evidence is transmitted to Vrf.
  arXiv  Detail & Related papers  (2026-03-02T18:26:17Z)
• SleepWalk: Exploiting Context Switching and Residual Power for Physical Side-Channel Attacks [2.6490401904186758]
  We introduce a physical power side-channel leakage source that exploits the power spike observed during a context switch.<n>We observed that this power spike directly correlates with both the power consumption during context switching and the residual power consumption of the previously executed program.
  arXiv  Detail & Related papers  (2025-07-30T00:39:27Z)
• Benchmarking of CPU-intensive Stream Data Processing in The Edge Computing Systems [41.19058376513831]
  This paper evaluates the power consumption and performance characteristics of a single processing node within an edge cluster using a synthetic microbenchmark.<n>Results show how an optimal measure can lead to optimized usage of edge resources, given both performance and power consumption.
  arXiv  Detail & Related papers  (2025-05-12T17:02:02Z)
• Power-consumption Backdoor in Quantum Key Distribution [0.0]
  We propose and implement a power side-channel analysis to a QKD system, by exploiting the power consumption of the electronic driver controlling the electro-optical components of the QKD transmitter. Our results are consistent and show critical information leakage, having reached a maximum accuracy of 73.35% in predicting transmitted qubits at a 100 MHz repetition frequency.
  arXiv  Detail & Related papers  (2025-03-14T18:01:11Z)
• MeMoir: A Software-Driven Covert Channel based on Memory Usage [7.424928818440549]
  MeMoir is a novel software-driven covert channel that, for the first time, utilizes memory usage as the medium for the channel. We implement a machine learning-based detector that can predict whether an attack is present in the system with an accuracy of more than 95%. We introduce a noise-based countermeasure that effectively mitigates the attack while inducing a low power overhead in the system.
  arXiv  Detail & Related papers  (2024-09-20T08:10:36Z)
• Information Leakage through Physical Layer Supply Voltage Coupling Vulnerability [2.6490401904186758]
  We introduce a novel side-channel vulnerability that leaks data-dependent power variations through physical layer supply voltage coupling (PSVC) Unlike traditional power side-channel attacks, the proposed vulnerability allows an adversary to mount an attack and extract information without modifying the device.
  arXiv  Detail & Related papers  (2024-03-12T23:39:54Z)
• SISSA: Real-time Monitoring of Hardware Functional Safety and Cybersecurity with In-vehicle SOME/IP Ethernet Traffic [49.549771439609046]
  We propose SISSA, a SOME/IP communication traffic-based approach for modeling and analyzing in-vehicle functional safety and cyber security. Specifically, SISSA models hardware failures with the Weibull distribution and addresses five potential attacks on SOME/IP communication. Extensive experimental results show the effectiveness and efficiency of SISSA.
  arXiv  Detail & Related papers  (2024-02-21T03:31:40Z)
• Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters [45.493130647468675]
  We present a kernel-level infrastructure that allows system-wide detection of malicious applications attempting to exploit cache-based side-channel attacks. This infrastructure relies on hardware performance counters to collect information at runtime from all applications running on the machine. High-level detection metrics are derived from these measurements to maximize the likelihood of promptly detecting a malicious application.
  arXiv  Detail & Related papers  (2024-02-18T15:45:38Z)
• SoK: Where's the "up"?! A Comprehensive (bottom-up) Study on the Security of Arm Cortex-M Systems [36.154629422941774]
  Arm Cortex-M processors are the most widely used 32-bit microcontrollers among embedded and Internet-of-Things devices. We analyze the hardware security limitations and issues of Cortex-M systems. We categorize the reported bugs in Cortex-M software systems.
  arXiv  Detail & Related papers  (2024-01-27T04:09:29Z)
• A Heterogeneous RISC-V based SoC for Secure Nano-UAV Navigation [40.8381466360025]
  nano-UAVs face significant power and payload constraints while requiring advanced computing capabilities. We present Shaheen, a 9mm2 200mW system-on-a-chip (SoC) It integrates a Linux-capable RV64 core, compliant with the v1.0 ratified Hypervisor extension, along with a low-cost and low-power memory controller. At the same time, it integrates a fully programmable energy- and area-efficient multi-core cluster of RV32 cores optimized for general-purpose DSP.
  arXiv  Detail & Related papers  (2024-01-07T16:03:47Z)
• DynamiQS: Quantum Secure Authentication for Dynamic Charging of Electric Vehicles [61.394095512765304]
  Dynamic Wireless Power Transfer (DWPT) is a novel technology that allows charging an electric vehicle while driving. Recent advancements in quantum computing jeopardize classical public key cryptography. We propose DynamiQS, the first post-quantum secure authentication protocol for dynamic wireless charging.
  arXiv  Detail & Related papers  (2023-12-20T09:40:45Z)
• Putting a Padlock on Lambda -- Integrating vTPMs into AWS Firecracker [49.1574468325115]
  Software services place implicit trust in the cloud provider, without an explicit trust relationship. There is currently no cloud provider that exposes Trusted Platform Module capabilities. We improve trust by integrating a virtual TPM device into the Firecracker, originally developed by Amazon Web Services.
  arXiv  Detail & Related papers  (2023-10-05T13:13:55Z)
• A Reinforcement Learning Approach for Performance-aware Reduction in Power Consumption of Data Center Compute Nodes [0.46040036610482665]
  We use Reinforcement Learning to design a power capping policy on cloud compute nodes. We show how a trained agent running on actual hardware can take actions by balancing power consumption and application performance.
  arXiv  Detail & Related papers  (2023-08-15T23:25:52Z)
• FLEdge: Benchmarking Federated Machine Learning Applications in Edge Computing Systems [61.335229621081346]
  Federated Learning (FL) has become a viable technique for realizing privacy-enhancing distributed deep learning on the network edge. In this paper, we propose FLEdge, which complements existing FL benchmarks by enabling a systematic evaluation of client capabilities.
  arXiv  Detail & Related papers  (2023-06-08T13:11:20Z)
• SamurAI: A Versatile IoT Node With Event-Driven Wake-Up and Embedded ML Acceleration [37.89976990030855]
  This paper presents SamurAI, a versatile IoT node bridging this gap in processing and in energy by leveraging two on-chip sub-systems. AR contains a 1.7MOPS event-driven, asynchronous Wake-up Controller (WuC) with a 207ns wake-up time optimized for sporadic computing. OD combines a deep-sleep RISC-V CPU and 1.3TOPS/W Machine Learning (ML) for more complex tasks up to 36GOPS.
  arXiv  Detail & Related papers  (2023-04-11T08:52:48Z)
• Enhancing the Security & Privacy of Wearable Brain-Computer Interfaces [7.972396153788745]
  Brain computing interfaces (BCI) are used in a plethora of safety/privacy-critical applications. They are susceptible to a multiplicity of attacks across the hardware, software, and networking stacks used. We introduce Argus, the first information flow control system for wearable BCI applications that mitigates these attacks.
  arXiv  Detail & Related papers  (2022-01-19T16:51:18Z)
• Catch Me If You Can: Using Power Analysis to Identify HPC Activity [0.35534933448684125]
  We show how electrical power consumption data from an HPC platform can be used to identify what programs are executed. We test our approach on an HPC rack at Lawrence Berkeley National Laboratory using a variety of scientific benchmarks.
  arXiv  Detail & Related papers  (2020-05-06T20:57:41Z)
• Enabling Pulse-level Programming, Compilation, and Execution in XACC [78.8942067357231]
  Gate-model quantum processing units (QPUs) are currently available from vendors over the cloud. Digital quantum programming approaches exist to run low-depth circuits on physical hardware. Vendors are beginning to open this pulse-level control system to the public via specified interfaces.
  arXiv  Detail & Related papers  (2020-03-26T15:08:32Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.