[Paper Review] TurboCC: A Practical Frequency-Based Covert Channel With Intel Turbo Boost

Manuel Kalmbach, Mathias Gottschlag+2 more|arXiv (Cornell University)|Jul 14, 2020

Security and Verification in Computing29 references4 citations

TL;DR

This paper presents TurboCC, a frequency-based covert channel exploiting Intel Turbo Boost to enable covert communication between isolated processes by modulating CPU frequency through controlled core activation. It achieves up to 61 bit/s on idle systems and maintains 12 bit/s under 37.5% background CPU load, making it resilient to real-world workloads and hard to block without performance penalties.

ABSTRACT

Covert channels are communication channels used by attackers to transmit information from a compromised system when the access control policy of the system does not allow doing so. Previous work has shown that CPU frequency scaling can be used as a covert channel to transmit information between otherwise isolated processes. Modern systems either try to save power or try to operate near their power limits in order to maximize performance, so they implement mechanisms to vary the frequency based on load. Existing covert channels based on this approach are either easily thwarted by software countermeasures or only work on completely idle systems. In this paper, we show how the automatic frequency scaling provided by Intel Turbo Boost can be used to construct a covert channel that is both hard to prevent without significant performance impact and can tolerate significant background system load. As Intel Turbo Boost selects the maximum CPU frequency based on the number of active cores, our covert channel modulates information onto the maximum CPU frequency by placing load on multiple additional CPU cores. Our prototype of the covert channel achieves a throughput of up to 61 bit/s on an idle system and up to 43 bit/s on a system with 25% utilization.

Motivation & Objective

• To develop a covert channel that remains effective under realistic system loads where prior frequency-based channels fail.
• To exploit Intel Turbo Boost's core-dependent frequency scaling for reliable cross-core communication.
• To design a channel resilient to background system load and practical countermeasures.
• To evaluate performance and robustness under varying workloads, including virtualized environments.
• To assess the feasibility of countermeasures that impact system performance.

Proposed method

• The transmitter modulates information by synchronously activating or deactivating multiple CPU cores to alter the maximum boost frequency.
• The receiver measures the current turbo frequency using a timing loop on a separate core to detect frequency changes.
• The system leverages Intel Turbo Boost 2’s behavior where frequency drops with increasing active cores, enabling frequency-based signaling.
• Error resilience is achieved via CRC-16 checksums and retransmission schemes, avoiding performance-heavy error-correcting codes.
• The channel uses a simple on/off signaling scheme based on the number of active cores, not individual core frequency changes.
• The approach avoids reliance on system call interfaces like sysfs, making it stealthier against OS-level access restrictions.

Experimental results

Research questions

• RQ1 Can a frequency-based covert channel remain effective under significant background CPU load, such as in production data centers?
• RQ2 How does Intel Turbo Boost’s core-dependent frequency scaling enable a practical covert channel?
• RQ3 What is the throughput of such a channel under realistic system conditions, including virtualization and background processes?
• RQ4 How effective are common countermeasures like CPU load noise in disrupting the channel, and what performance cost do they incur?
• RQ5 Can the channel be made robust without relying on complex error-correcting codes?

Key findings

• The prototype achieves a throughput of 61 bit/s on an idle system, demonstrating high performance under ideal conditions.
• Even with 25% background CPU utilization, the channel maintains 43 bit/s, showing strong resilience to moderate load.
• Under 37.5% background load, the channel still transmits 12 bit/s, proving viability in real-world environments.
• The channel remains effective despite virtualization overheads that degrade similar prior channels.
• Countermeasures such as artificial CPU load noise significantly reduce throughput but incur a substantial performance penalty.
• The use of CRC-16 and retransmission outperforms complex error-correcting codes like Reed-Solomon in terms of performance efficiency.