The Temperature Side Channel and Heating Fault Attacks

Abstract

Abstract. In this paper, we present practical results of data leakages of CMOS devices via the temperature side channel-a side channel that has been widely cited in literature but not well characterized yet. We investigate the leakage of processed data by passively measuring the dissipated heat of the devices. The temperature leakage is thereby linearly correlated with the power leakage model but is limited by the physical properties of thermal conductivity and capacitance. We further present heating faults by operating the devices beyond their specified temperature ratings. The efficiency of this kind of attack is shown by a practical attack on an RSA implementation. Finally, we introduce data remanence attacks on AVR microcontrollers that exploit the Negative Bias Temperature Instability (NBTI) property of internal SRAM cells. We show how to recover parts of the internal memory and present first results on an ATmega162. The work encourages the awareness of temperature-based attacks that are known for years now but not well described in literature. It also serves as a starting point for further research investigations.

Plundervolt: Software-based Fault Injection Attacks against Intel SGX

“…Typically such fault-inducing environments are at the border of (or beyond) the specified operational range of the target device. Different environment manipulations have been investigated [26], such as: exposure to voltage and clock glitching [2,62], extreme temperatures [29] or laser/UV light [63].…”

Taxonomies for Reasoning About Cyber-physical Attacks in IoT-based Manufacturing Systems

“…By observing the power consumption of a cryp tosystem, it is possible to deduce the key bits of RSA [19] or even to break the key [20]. Some other sidechannel impacts include timing delays [20], electromagnetic leaks [21], tempera ture [22], or radiation [21]. Quality inspection in IoT-based manufacturing can meas ure side-channel impacts as well, to determine if a manufac tur ing process deviates from its designed specifica tions.…”

ThermalAttackNet: Are CNNs Making It Easy To Perform Temperature Side-Channel Attack In Mobile Edge Devices?

“…Such mobile devices have to face hostile security threats [4]- [7] such as physical, logical/software-based and side-channel/lateral attacks. Amongst these, side-channel attack [4]- [6] is a popular security threat due to ease of access to the physical hardware where attacks are performed by observing the properties and behavior of the system such as power consumption, thermal dissipation, electromagnetic emission, etc.…”

“…Comparatively a lot less documented studies are performed in temperature (thermal) based side channel attacks [4]- [6] in mobile edge devices. Most of these mobile devices come equipped with heterogeneous multi-processors systemson-chip (MPSoC), which consists of multiple heterogeneous processors on a single chip, capable of processing different types of applications to cater for performance and energyefficiency of the executing applications.…”

“…Most of these mobile devices come equipped with heterogeneous multi-processors systemson-chip (MPSoC), which consists of multiple heterogeneous processors on a single chip, capable of processing different types of applications to cater for performance and energyefficiency of the executing applications. Due to an increase in the usage of MPSoCs [2], [8]- [13] in mobile edge devices and a rise in studies on thermal side channel attacks [6], [14], [15], it is crucial that side channel attacks in such platform should be addressed with utmost importance [15].…”