‘Hot Pixel’ Attack Steals Data From Apple, Intel, Nvidia, and AMD Chips via Frequency, Power and Temperature Info
A team of security researchers funded in part by DARPA and the U.S. Air Force makes it possible to steal data from Arm CPUs from Apple and Qualcomm, discrete GPUs from Nvidia and AMD, and integrated graphics on Intel and Apple chips. proven tactics. Monitor chip temperature, power, and frequency during normal operation. The attack requires data from the PC’s internal power, temperature, and frequency sensors, which can be accessed by user accounts without administrator access. The researcher’s current attack method serves as a proof of concept, but fortunately, the current method has a very low data exfiltration rate. However, researchers note that further research could speed up the process.
Researcher’s paper “Hot Pixels: Frequency, Power and Thermal Attacks on GPUs and Arm SoCs” [PDF]” shows the use of side-channel attacks. This is a type of attack that allows data to be leaked by measuring certain physical emissions of a computer.
In this case, the researchers leveraged information exposed by the dynamic voltage and frequency scaling (DVFS) mechanism present in nearly all modern chips. DVFS adjusts frequency and power in real-time to keep heat and TDP at acceptable levels, resulting in the best power efficiency or best performance for the tasks currently running on your processor. This is controlled by her P-state of the chip the researchers used to collect the data.
By forcing one of the three DVFS variables (heat, power, or frequency) to be constant, researchers can monitor the other two variables to distinguish which instructions are being executed . Even if it’s precise enough to see the various operands of that variable. same instructions.
Ultimately, this facilitates other attacks such as website fingerprinting. Additionally, by monitoring frequency throttling via Javascript code running in the browser, the researchers found that the latest versions of Chrome and Safari, despite all side-channel mitigations enabled, We used pixel-stealing and history-sniffing attacks.
image 1 of 3
Here you can see some of the monitoring work the researchers did to observe DVFS variables on Apple’s M1 and M2, Qualcomm Snapdragon 8 Gen 1, and Google Tensor processors.
The researchers found that some chips leak data through power and frequency data to try to meet thermal constraints, while others leak data through variable power and thermal data to operate at fixed frequencies. Focused on leaking data. Both types of manipulation are vulnerable to these attack methods.
image 1 of 6
Above you can see some of the tests used to extract data from Apple’s integrated GPUs present in the M1 and M2, the AMD Radeon RX 6000 and Nvidia RTX 3060 discrete GPUs, and the Intel Iris XE integrated graphics. .
The researchers say the speed of data extraction is currently limited to 0.1 bits per second, but could be optimized in future work. Also, thermally constrained devices can take a ‘significant’ time to reach steady state. Additionally, using API blocks for temperature and frequency metrics can thwart attacks, and adding active cooling to otherwise passive devices such as the Apple M1 SoC can also mitigate attacks.
The U.S. Air Force, DARPA, NSF and others have funded the research, including contributions from Qualcomm and Cisco, but the authors say the views in the paper should not be considered those of the U.S. government. said.
The researchers have committed to responsible disclosure practices and notified the Apple, Nvidia, AMD, Qualcomm, Intel and Google Chrome teams. This document states that all vendors are aware of the issues described in this document. We do not yet know any mitigations for this attack, but we will contact the vendor and update as needed.
