TurboCC: A Practical Frequency-Based Covert Channel With Intel Turbo Boost

Abstract

Covert channels are communication channels used by attackers to transmit information from a compromised system when the access control policy of the system does not allow doing so. Previous work has shown that CPU frequency scaling can be used as a covert channel to transmit information between otherwise isolated processes. Modern systems either try to save power or try to operate near their power limits in order to maximize performance, so they implement mechanisms to vary the frequency based on load. Existing covert channels based on this approach are either easily thwarted by software countermeasures or only work on completely idle systems.In this paper, we show how the automatic frequency scaling provided by Intel Turbo Boost can be used to construct a covert channel that is both hard to prevent without significant performance impact and can tolerate significant background system load. As Intel Turbo Boost selects the maximum CPU frequency based on the number of active cores, our covert channel modulates information onto the maximum CPU frequency by placing load on multiple additional CPU cores. Our prototype of the covert channel achieves a throughput of up to 61 bit/s on an idle system and up to 43 bit/s on a system with 25% utilization.

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors

“…Kalmbach et al [57] propose TurboCC, a mechanism that creates cross-core covert channels by exploiting the core frequency throttling when executing PHIs (e.g., AVX2) at Turbo frequencies [89,90]. We identify two main limitations in Tur-boCC.…”

“…We describe two state-of-the-art covert channels, NetSpectre [91] and TurboCC [57], and their major limitations based on our rigorous characterization (which is provided in Section 5).…”

“…Attacker Model. We assume a standard threat model for a covert channel attack [5,57,59,63,72,91,108,115]. Such a threat model consists of two malicious user-level attacker applications, sender and receiver, that cannot communicate legitimately through overt channels.…”

“…As the throttling side-effects of these mechanisms are observable across different software contexts, they can be used to break the confidentiality guarantees of the whole system. Recent works [57,91] demonstrate methods for creating covert channels via side-effects that arise due to the two different throttling techniques employed by the current management mechanisms of modern processors: 1) the voltage emergency avoidance mechanism [20,29,54,83,84] and 2) the voltage and current limit protection mechanism [10,20,29,32,46,49,68,74,81,107,114,116], both of which we explain in Section 2. Unfortunately, these recent works are limited in creating covert channels and proposing countermeasures due to the limited or inaccurate observations they are built on, as we describe in Section 3.…”

“…We demonstrate IChannels on real modern Intel processors and find that IChannels provides 3Kbps of covert channel capacity, which is more than 24× the capacity of state-of-theart power management-based covert channels [5,57,59] and 2× the capacity of state-of-the-art PHI-latency-variation-based covert channels [91].…”