PowerHammer: Exfiltrating Data From Air-Gapped Computers Through Power Lines

Abstract

In this paper we provide an implementation, evaluation, and analysis of PowerHammer, a malware (bridgeware [1]) that uses power lines to exfiltrate data from air-gapped computers. In this case, a malicious code running on a compromised computer can control the power consumption of the system by intentionally regulating the CPU utilization. Data is modulated, encoded, and transmitted on top of the current flow fluctuations, and then it is conducted and propagated through the power lines. This phenomena is known as a 'conducted emission'. We present two versions of the attack. Line level powerhammering: In this attack, the attacker taps the in-home power lines 1 that are directly attached to the electrical outlet. Phase level power-hammering: In this attack, the attacker taps the power lines at the phase level, in the main electrical service panel. In both versions of the attack, the attacker measures the emission conducted and then decodes the exfiltrated data. We describe the adversarial attack model and present modulations and encoding schemes along with a transmission protocol. We evaluate the covert channel in different scenarios and discuss signal-to-noise (SNR), signal processing, and forms of interference. We also present a set of defensive countermeasures. Our results show that binary data can be covertly exfiltrated from air-gapped computers through the power lines at bit rates of 1000 bit/sec for the line level power-hammering attack and 10 bit/sec for the phase level power-hammering attack. Power stationStep up transformerStep down transformerStep down transformer Residential building 22kV output 400 kV 132 kV 11 kV Fig. 1: A (simplified) schematic diagram of the electricity network C. Exfiltration through Power LinesIn this paper, we present a new type of electric (current flow) covert channel. The method, dubbed PowerHammer, enables attackers to exfiltrate information from air-gapped networks through AC power lines. We show that a malware running on a computer can regulate the power consumption of the system by controlling the workload of the CPU. Binary data can be modulated on the changes of the current flow, propagated through the power lines, and intercepted by an attacker. We present two versions of the attack. In line level power-hammering the adversary taps the power cables feeding the transmitting computer. In phase level power-hammering the adversary taps the power lines at the phase level, in the main electrical service panel. Using a non-invasive tap, the attacker measures the emission conducted on the power cables. Based on the signal received, the transmitted data is demodulated and decoded back to a binary form.

PLATYPUS: Software-based Power Side-Channel Attacks on x86

“…Guri et al [33], as well as Islam and Ren [45] demonstrated that current and voltage, respectively, can be monitored and influenced to build covert channels, e.g., in cloud environments. However, both works assume an attacker with hardware equipment connected to the device.…”

C3APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

“…It is well-known that data-dependent power consumption can be used to recover cryptographic keys through differential power analysis and other techniques by acquiring and analyzing power traces [23]. The same principles can be applied to create covert communication, for example from a malware app on a phone to a malicious USB charger [33], or from a program that modulates CPU utilization to an attacker measuring the current consumption of the computer [17]. Similarly, measuring voltage ripple on the power lines can be used to track the power usage pattern of other data center tenants [20].…”

WaterLeakage: A Stealthy Malware for Data Exfiltration on Industrial Control Systems Using Visual Channels

“…In [22], authors proposed a malware named PowerHammer that uses power lines to exfiltrate sensitive data from a compromised air-gapped computer. An airgapped computer is a computer located in a secured network/environment for which comprehensive security measures are taken into account to maintain both physical and logical separation from less secured computer/environment/networks.…”