Energy management systems that power modern mobile devices are proving to have poor security design, as evidenced by the recent attack method CLKscrew. This is largely due to an emphasis on longer battery life, portability and efficiency rather than security.

Researchers from Columbia University presented their findings about CLKscrew attacks in a paper titled, “CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management,” at the Vancouver USENIX Security Symposium, which detailed how energy management systems could be a way into the processors used in mobile devices. The researchers also showed that the dearth of security found in such systems could allow a remote attack along with the exfiltration of data.

DVFS Affects All Hardware

Analysts focused on dynamic voltage and frequency scaling (DVFS). They studied the ARMv7 processor in particular, but the same sort of system is used on many devices.

The CLKscrew attack does not require physical access to the device or other fault injection equipment, according to the researchers. What it does is bypass the operating limits the vendor has placed on the device. This allows the attack to generate faults that can be exploited through a kernel driver, with a goal of inducing a fault in a subset of an entire victim-thread execution.

The problem stems from a design choice made by the vendors: The voltage and frequency regulators operate on domains that apply to all cores. As the researchers pointed out in their paper, “Any frequency or voltage change initiated by untrusted code inadvertently affects the trusted code execution, despite the hardware-enforced isolation.”

However, the analysts also noted that “the root cause is not a specific hardware or software bug but rather a series of well-thought-out, nevertheless security-oblivious, design decisions.”

Security Not Baked Into Energy Management Systems

SecurityWeek reported that this sort of attack could be used to extract cryptokeys from the ARM’s TrustZone and escalate privileges by loading self-signed code into the TrustZone. Any overlaid operating system (OS), such as Android, could be compromised by the attack.

The researchers said that appropriate vendors have been notified of this situation and mitigation efforts are currently underway.

CLKscrew is a brand new kind of attack that may be only the beginning of others seeking to exploit hardware vulnerabilities. Security professionals must be aware that this avenue exists at all and look to vendors to correct it.