DF-SCA: Dynamic Frequency Side Channel Attacks are Practical
Published in Proceedings of the 38th Annual Computer Security Applications Conference (ACSAC '22), 2022
Modern CPUs scale their core frequency with system utilization, and Linux exposes the current frequency to unprivileged users through the cpufreq interface. DF-SCA shows that these real-time frequency readings are a practical software-based side channel. Using them, an attacker identifies the websites a victim visits in Google Chrome and Tor Browser on modern Intel, AMD, and ARM systems, and every scaling governor we tested on Intel and AMD leaks enough information to identify the page. On Android, the channel separates keystrokes from other activity with 95% accuracy, and a k-nearest-neighbor model trained on inter-keystroke timings recovers a Bank of America app password on the first guess in 88% of trials. We also propose mitigations that mask user activity on Linux-based systems.
Recommended citation: D. R. Dipta and Berk Gulmezoglu, "DF-SCA: Dynamic Frequency Side Channel Attacks are Practical," Proceedings of the 38th Annual Computer Security Applications Conference (ACSAC '22), Association for Computing Machinery, New York, NY, USA, 841–853, 2022.
Download Paper