> By forcing one of the three variables of DVFS (heat, power, or frequency) to become a constant, the researchers can then monitor the other two variables to distinguish which instructions are being executed, even with enough precision to ascertain the different operands of the same instruction.<p>Sounds like one of those attacks that works in theory but is too impractical to use in real life. This is harder than cache side channel attacks, and we still haven’t seen much use of those in the wild, years later.<p>> Ultimately, this furthers other attacks, like website fingerprinting.<p>Umm no. Did ChatGPT write that? Fingerprinting isn’t an attack and that’s not how it works. Also this requires access to system temperatures and other metrics that are absolutely not available from JavaScript.
I found the paper didn't live up to its claims. It said:
<i>the ever-changing behavior of these SoCs is also visible via internal measurement sensors, allowing us to distinguish between executed instructions, and even different operands of the same instruction</i><p>But when you read further and see what they tried:<p><i>We then selected one Arm instruction from each data-processing bucket,testingstores(str),AESinstructions(aese, aesmc), rotate right (ror), bitwise and (and), and both integer and floating-point addition (add, fadd) and multiplication (mul, fmul). We run each instruction in a loop on all available P-cores on each test device</i><p>What they did is define a handful of known workloads, with very different power profiles. And then they find that they can tell them apart by looking at the power of the chip. Well, duh.
>The attack requires data from the PC's internal power, temp, and frequency sensors, but this information can be accessed from user accounts that don't have administrator access<p>Looks like only a local user can do this, but the article is not to clear on that.<p>Anyway this seems very hard to do. Also I wonder if using OpenBSD's port obsdfreqd can prevent this. Based upon usage, it will adjust the frequency and CPU Temp on the fly.<p><a href="https://tildegit.org/solene/obsdfreqd" rel="nofollow">https://tildegit.org/solene/obsdfreqd</a><p>edit: grammer
This highlights subtly different thinking processes in the security industry. Real world adversaries think "this is an interesting asset, how can we get to it, with our available primitives?" whereas academic researchers think "this is an interesting primitive, what kind of assets would make the paper work?".
The article mentions 0.1 bit per second, but cpu's are handling mb's in seconds, so is this actually sufficient, even at 1 bit per second, to gain any useful insight from the system?
Table 19 from the paper seems to show pixel extraction accuracy is highest for AMD Radeon (94%) but lower for M1/M2 (~60%). Can't seem to find an explanation for this variation though. Thoughts?