PowerHammer carried covert data through electrical power lines

Reconstruction

PowerHammer treats the protected computer's power feed as the communications medium. Malware varies CPU utilization in a deliberate pattern, causing corresponding changes in the machine's electrical current draw. Those fluctuations are conducted onto the connected power wiring, where a measurement device can observe and decode them.

The channel exists because electrical isolation is different from network isolation. Every powered computer is physically connected to a conductive infrastructure, and software-controlled workloads change how much current the system consumes. In the researchers' tested setup, a line-level tap closer to the machine reached about 1,000 bit/s, while phase-level measurement at the electrical panel reached about 10 bit/s.

The receiver requirement is substantial: the attacker needs access to a suitable electrical measurement point. PowerHammer therefore does not create remote exfiltration by itself; it demonstrates that the power distribution system can become an unintended outbound conductor when both workload control and measurement access exist.

Mechanism & boundary

1. 01

   Execute code on the isolated computer

   The transmitter is malware already running on the protected system.

   Boundary: air-gapped host / attacker-controlled code

2. 02

   Encode data in CPU utilization

   The malware raises and lowers processor load according to the bitstream.

   Boundary: secret data / compute workload

3. 03

   Convert workload into current fluctuations

   Changes in processor demand alter system power consumption and therefore current on the supply line.

   Boundary: software activity / electrical current

4. 04

   Conduct the signal through power wiring

   The data-dependent current pattern propagates along the connected electrical infrastructure.

   Boundary: computer power input / building wiring

5. 05

   Measure and decode at a tap point

   A prepared line-level or phase-level sensor records the fluctuations and reconstructs the transmitted data.

   Boundary: power infrastructure / attacker receiver

Timeline

1. Apr 10, 2018

   PowerHammer preprint released

   report

   The paper described line-level and phase-level power-line exfiltration and reported their tested bit rates.

Claims & evidence

Implications

PowerHammer shows that an air gap leaves conductive infrastructure intact. Its operational risk is bounded by the attacker's ability to measure the relevant electrical path and by signal quality in the facility. For high-assurance design, power feeds and panels are therefore part of the containment boundary rather than neutral utilities outside it.

Controls & mitigations

• Restrict physical access to line-level wiring, distribution panels and other useful current-measurement points.
• Use power filtering or isolation appropriate to the protected environment and verify effectiveness against the frequencies of concern.
• Monitor abnormal current signatures or patterned CPU-load behavior only where normal workload variability permits meaningful detection.

What remains unknown

• The paper's reported rates come from specific line-level and phase-level measurement setups and should not be generalized to arbitrary buildings.
• Electrical noise, power-supply design, wiring topology and measurement placement materially affect the channel.
• The channel assumes prior host compromise and a prepared receiver on the power infrastructure.

Connected research