Beyond TEMPEST: Workload-Modulated Power-Quality Covert Channels in Air-Gapped Systems
This study demonstrates that air-gapped computers can leak sensitive data through power-line covert channels by modulating processor workloads to alter power factor and current harmonics, successfully recovering transmitted payloads even across various power supply topologies and at distant office-level connection points.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a computer that is completely cut off from the internet, a digital fortress designed to keep its secrets safe from prying eyes. This is an air-gapped system, a machine with no network cables and no wireless signals, isolated physically from the outside world. For decades, security experts have believed that this physical separation is enough to stop data theft. However, computers are not just logical machines; they are physical objects that interact with their environment. They generate heat, make noise, and, crucially, draw electricity from the wall. Every time a computer works, it changes the way it pulls power. This study explores a hidden vulnerability in that very connection: the idea that a compromised computer can use the electricity flowing through its power cord to send secret messages out of the room, bypassing the air gap entirely.
The researchers focused on a specific type of electrical behavior known as power quality. When a computer runs, its power supply converts the steady flow of electricity from the wall into the precise energy the processor needs. This process is not perfectly smooth. Depending on how hard the computer is working, the electrical current can become slightly distorted, creating ripples and shifts in the waveform. The team investigated whether these subtle changes could be used to encode information. They treated the computer's workload like a switch, turning the processor's activity up and down in a pattern that represented binary data, the ones and zeros of digital communication. By carefully controlling the computer's load, they could modulate the electricity itself, turning the power line into a covert communication channel.
To test this, the team set up a desktop computer and connected it to three different types of power supplies, each designed to handle electricity in a slightly different way. One supply had no special features to clean up the electricity, another used a passive method to smooth the flow, and the third used an active system to tightly control the current. They then recorded the voltage and current at two locations: right at the computer's power cord and further up the line, at a point representing a typical office outlet shared with other devices. The goal was to see if the secret message, encoded in the computer's workload, could be detected and decoded from the electrical noise at these points.
The results showed that the computer could indeed send data through the power line. By switching the processor between idle and full load states, the researchers successfully transmitted small amounts of information, such as text strings and cryptographic keys. The data was sent at very slow speeds, roughly half a bit per second, which is far too slow for sending large files but fast enough to leak passwords or secret commands. The study found that the type of power supply made a significant difference. The older, simpler power supplies that did not actively correct the power flow allowed the secret signals to pass through clearly. Even the passive correction systems let the message through, though with more difficulty. However, the most advanced power supplies, which actively shape the electricity to be as smooth as possible, made it much harder to detect the signal. In these cases, the secret message was often lost in the noise, especially when measured from a distance at the office-level outlet.
Despite the challenges, the researchers managed to recover complete messages in several scenarios. They demonstrated that even when the signal was mixed with the electrical noise of other devices in the building, specific patterns in the power quality could still reveal the hidden data. This suggests that the threat is real, even if it requires specific conditions to work effectively. The study did not prove that this method works in every building or with every computer, as the experiment was conducted under controlled conditions with a single setup. However, it provided concrete evidence that the electrical infrastructure itself can be a pathway for data exfiltration.
The implications of this finding are significant for high-security environments. It means that simply unplugging a computer from the network is not enough to guarantee safety. The power cord remains a persistent connection to the outside world, capable of carrying information if the software inside the machine is compromised. While modern power supplies with active correction offer some protection by smoothing out the electrical signature, they are not a complete shield. The study concludes that security models for isolated systems must now include the electrical supply as a potential vector for attack. Defenders may need to monitor power quality for suspicious patterns or ensure that critical systems use the most advanced power conditioning available. The research opens a new chapter in understanding how physical laws can be exploited to break digital isolation, reminding us that in the physical world, there are no perfect barriers.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.