POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers

It is known that attackers can exfiltrate data from air-gapped computers through their speakers via sonic and ultrasonic waves. To eliminate the threat of such acoustic covert channels in sensitive systems, audio hardware can be disabled and the use of loudspeakers can be strictly forbidden. Such audio-less systems are considered to be \textit{audio-gapped}, and hence immune to acoustic covert channels. In this paper, we introduce a technique that enable attackers leak data acoustically from air-gapped and audio-gapped systems. Our developed malware can exploit the computer power supply unit (PSU) to play sounds and use it as an out-of-band, secondary speaker with limited capabilities. The malicious code manipulates the internal \textit{switching frequency} of the power supply and hence controls the sound waveforms generated from its capacitors and transformers. Our technique enables producing audio tones in a frequency band of 0-24khz and playing audio streams (e.g., WAV) from a computer power supply without the need for audio hardware or speakers. Binary data (files, keylogging, encryption keys, etc.) can be modulated over the acoustic signals and sent to a nearby receiver (e.g., smartphone). We show that our technique works with various types of systems: PC workstations and servers, as well as embedded systems and IoT devices that have no audio hardware at all. We provide technical background and discuss implementation details such as signal generation and data modulation. We show that the POWER-SUPPLaY code can operate from an ordinary user-mode process and doesn't need any hardware access or special privileges. Our evaluation shows that using POWER-SUPPLaY, sensitive data can be exfiltrated from air-gapped and audio-gapped systems from a distance of five meters away at a maximal bit rates of 50 bit/sec

Worst-case energy consumption: A new challenge for battery-powered critical devices

The number of devices connected to the IoT is on the rise, reaching hundreds of billions in the next years. Many devices will implement some type of critical functionality, for instance in the medical market. Energy awareness is mandatory in the design of IoT devices because of their huge impact on worldwide energy consumption and the fact that many of them are battery powered. Critical IoT devices further require addressing new energy-related challenges. On the one hand, factoring in the impact of energy-solutions on device's performance, providing evidence of adherence to domain-specific safety standards. On the other hand, deriving safe worst-case energy consumption (WCEC) estimates is a fundamental building block to ensure the system can continuously operate under a pre-established set of power/energy caps, safely delivering its critical functionality. We analyze for the first time the impact that different hardware physical parameters have on both model-based and measurement-based WCEC modeling, for which we also show the main challenges they face compared to chip manufacturers' current practice for energy modeling and validation. Under the set of constraints that emanate from how certain physical parameters can be actually modeled, we show that measurement-based WCEC is a promising way forward for WCEC estimation.This work has been partially supported by the Spanish Ministry of Economy and Competitiveness (MINECO) under grant TIN2015- 65316-P and the HiPEAC Network of Excellence. Jaume Abella has been partially supported by the MINECO under Ramon y Cajal postdoctoral fellowship number RYC-2013-14717. Carles Hernndez is jointly funded by the MINECO and FEDER funds through grant TIN2014-60404-JIN.Peer ReviewedPostprint (author's final draft

Etude de l'influence de la température du processeur sur la consommation des serveurs

National audienceLa part croissante des data centers dans la consommation énergétique mondiale suscite beau-coup d'inquiétude. Pour bien identifier les impacts énergétiques des matériels et logiciels uti-lisés dans les data centers, les travaux décrits ici visent à développer un outil de modélisation prédictive de la consommation énergétique des serveurs en tenant compte de l'architecture matérielle, du service rendu et de leur environnement technique. L'influence des CPU 1 est particulièrement étudiée car il s'agit du composant électronique du serveur consommant le plus. En situation réelle, la consommation énergétique du CPU dépend principalement de la charge informatique. Etant donné que la puissance augmente, la chaleur dissipée augmente et la température du composant également. Par ailleurs cette augmentation de la température induit une augmentation des courants de fuite, qui contribue aussi à une augmentation de la consommation énergétique et cela n'a pas été caractérisé précisément. Pour bien déterminer cet impact, nous avons utilisé des serveurs équipés de différentes générations de CPU sous une même sollicitation logicielle et nous avons fait varier la température de la surface du CPU en changeant la vitesse de ventilateurs. Ces derniers sont alimentés par une source d'alimen-tation DC externe afin que la consommation énergétique globale soit indépendante du fonc-tionnement du ventilateur. Nos résultats montrent que cet impact peut être très important. Des essais supplémentaires montrent que l'influence de la température des autres composants sur la consommation du serveur peut être négligée

An Empirical Study of Power Characterization Approaches for Servers

International audienceData centers are energy-hungry facilities. Emerging studies have proposed energy-aware solutions for reducing the power consumption of data centers. Power consumption characterization of servers is an essential part to realize power-aware adaption strategies. Traditional methods adopt accuracy andsecure direct measurements by using physical instruments such as wattmeters. Recently, watt-meter free solutions are adopted widely as an economical replacement. These solutions provide power consumption information by making use of self-resources without additional instruments. There are two commonly adopted solutions: 1) standard specifications that provide interface with integrated sensors, such as Intelligent Platform Management Interface (IPMI) and Redfish; 2) Power models based on system activity related indicators. The energy-aware scheduling decisions are made based on the power values obtained, but few works give information about the correctness of the power values while discussing the results or drawing conclusions. In this study, we try to fill up this missing part by evaluating some commonly used, economical ways in obtaining power values. We compare and discuss the reliability, advantages and limitations for the CPU-utilization based power models. The findings highlight the challenges in realizing accurate and reliable power models. We also evaluate the reliability of IPMI and RedFish, in order to give references in choosing appropriate power characterization solutions

Taming Energy Consumption Variations in Systems Benchmarking

International audienceThe past decade witnessed the inclusion of power measurements to evaluate the energy efficiency of software systems, thus making energy a prime indicator along with performance. Nevertheless, measuring the energy consumption of a software system remains a tedious task for practitioners. In particular, the energy measurement process may be subject to a lot of variations that hinder the relevance of potential comparisons. While the state of the art mostly acknowledged the impact of hardware factors (chip printing process, CPU temperature), this paper investigates the impact of controllable factors on these variations. More specifically, we conduct an empirical study of multiple controllable parameters that one can easily tune to tame the energy consumption variations when benchmarking software systems.To better understand the causes of such variations, we ran more than a 1000 experiments on more than 100 machines with different workloads and configurations. The main factors we studied encompass: experimental protocol, CPU features (C-states, Turbo~Boost, core pinning) and generations, as well as the operating system. Our experiments showed that, for some workloads, it is possible to tighten the energy variation by up to 30×. Finally, we summarize our results as guidelines to tame energy consumption variations. We argue that the guidelines we deliver are the minimal requirements to be considered prior to any energy efficiency evaluatio

Adaptation-Aware Architecture Modeling and Analysis of Energy Efficiency for Software Systems

This work presents an approach for the architecture analysis of energy efficiency for static and self-adaptive software systems. It introduces a modeling language that captures consumption characteristics on an architectural level. The outlined analysis predicts the energy efficiency of systems described with this language. Lastly, this work introduces an approach for considering transient effects in design time architecture analyses