‘Hot pixel’ attack steals data via CPU readings, all devices tested were spared

A joint team from the Georgia Institute of Technology, the University of Michigan, and Ruhr-Universität Bochum in Germany report a new form of side-channel attack that exploits power and speed management methods used by graphics processing units and systems on a chip (SoC). Dynamic Voltage and Frequency Scaling (DVFS) mechanisms on most modern chips release data, and the research team shows how they can steal personal information.

As manufacturers race to develop thinner, more power-efficient devices, they must balance power consumption, heat generation and processing speed. But researchers recently published a paper on the preprint server arXiv pointing out that SoC exhibits instruction- and data-dependent behavior precisely because of efforts to make trade-offs among the three parties.

Using four categories of devices: SoC units, Intel CPUs, AMD and Nvidia GPUs, the team was able to detect behavioral patterns that occur as processors constantly balance power demands and thermal constraints. This was revealed through data leaked from sensors embedded in the processor. This "hot pixel" attack forces one of the variables tracked by DVFS to remain unchanged. By monitoring the other two variables, they are able to determine which instructions are being executed.

Such leaks are common: So-called ARM chips in smartphones, which contain passively cooled processors, leak data containing power and frequency readings; actively cooled processors in desktop devices may leak data through temperature and power readings.

By reading this data, researchers deployed several types of attacks, such as history sniffing and website fingerprinting. The results show that hackers can sniff browsing history by detecting different colors of links that a user has previously visited. Once a sensitive site, such as a bank, is identified, hackers can provide links to fake sites that resemble the real site.

The researchers tested devices such as Apple MacBook Air (M1 and M2), Google Pixel 6 Pro, OnePlus 10 Pro, Nvidia GeForce RTX 3060, AMD Radeon RX 6600 and Intel Iris Xe (i7-1280P). All devices leaked data, with the AMD Radeon RX 6600 performing the worst, with an unauthorized data extraction accuracy rate of 94%. Apple devices received the highest ratings, with data retrieval accuracy ranging from only 60% to 67%.

The researchers have notified all affected manufacturers of the vulnerabilities and recommend that manufacturers implement hardware-based thermal throttling that limits unprivileged access to sensor readings.