Hardware Analysis Series – Part 4: Hacking through power consumption

By Kike Gandia · Hardware & OT · 18 min read

Picture a hacker hunched over an electronic device, not to inject malicious code but to listen to its electrical heartbeat. Every digital device has an energy "pulse": tiny fluctuations in current draw as it carries out its internal operations. Power analysis exploits this physical phenomenon, turning those fluctuations into clues about what is happening inside the chip. These are side-channel attacks: techniques that exploit the physical side effects of hardware, rather than software vulnerabilities, to steal secrets. It's like reading a circuit's private diary by watching the needle on its electricity meter instead of picking the lock on its data.

In cybersecurity, these tactics sound like electronic witchcraft: deducing passwords, cryptographic keys and sensitive data simply by observing the electricity a device consumes. The cryptography itself is not broken; the physical implementation is. When a microcontroller encrypts a message or verifies a digital signature, the secret bits leave a subtle trace in the current drawn by its transistors. Power analysis consists of capturing and decoding that trace, reading between the electrical lines to extract confidential information without touching the software or tripping any logical alarms.

Keys in plain sight in power patterns

To understand how confidential information can be extracted from power patterns, think of an everyday example: if you switch on every appliance in your home at once, your electricity meter goes haywire. In the same way, a complex cryptographic operation "switches on" more internal circuitry and draws more power than a simple one. Even the difference between a 1 bit and a 0 bit in certain registers can slightly affect the current drawn. These changes are minute but measurable. A skilled attacker armed with sensitive instruments can collect power traces (time-series recordings of current or voltage) while the device handles secret data. They then apply analysis methods to find correlations between the peaks and troughs in power consumption and the internal processes the chip is running.

For example, a power trace can show when a chip is multiplying rather than adding, because multiplication usually draws more current. In one famous case, researchers managed to read a complete RSA key because, on the power plot, every 1 bit in the key produced a higher peak than every 0 bit. The electrical signature gave the key away like Morse code. Similarly, in ciphers such as AES, certain patterns in power consumption can point to operations involving part of the key; by repeating the process with different input data, the key can be reconstructed byte by byte. In short, hardware unintentionally "talks" through its power consumption, and anyone who knows how to listen can reconstruct secrets that were supposed to be buried behind cryptographic walls.

The idea in one sentence. A power trace can show when a chip is multiplying rather than adding. If the algorithm does one or the other depending on the key bit, the trace draws the key.

Anatomy of power and timing attacks

Not all of these attacks are carried out the same way. There are variants depending on the depth of the analysis and the type of signal observed:

SPA SPA (Simple Power Analysis): Simple power analysis: this is the most basic form. It involves looking directly at a single power trace and trying to identify obvious patterns by eye or with minimal filtering. If the device has no countermeasures and its operations differ enough, a single power recording can reveal, for example, the sequence of operations in an algorithm. A classic: in certain RSA implementations, every "1" in the private key produces a distinctive peak on the power plot compared with a "0", allowing the key to be read bit by bit. SPA has been used to distinguish entire routines (for example, spotting the DES rounds on a smart card) from the power profile alone. It is a simple but powerful method when noise is low and the signal "sings" without much help.
DPA DPA (Differential Power Analysis): Differential power analysis: what if the signal is subtler or buried in noise? This is where DPA comes in, an advanced statistical technique. Instead of a single trace, the attacker captures tens, hundreds or thousands of measurements while the device performs operations on different data. They then split those traces into groups according to some criterion tied to a hypothetical secret value (for example, whether a certain internal bit might be 0 in some traces and 1 in others). By averaging and subtracting the groups, uncorrelated variations (noise, or irrelevant operations) tend to cancel out, leaving a small, telling difference if the hypothesis was correct. Repeating this process with different guesses, the attacker narrows down the possible values of the secret key until they hit the right one. DPA takes more computational effort and many samples, but it can extract tiny amounts of information buried in a lot of noise, invisible to the naked eye. Its introduction in the late 1990s shook the world of embedded cryptography, showing that even secure algorithms (DES, AES, etc.) could be defeated in practice with modest resources. In fact, DPA can achieve in minutes what a brute-force attack would take eons to do, because it reduces the search for a key from 2^128 possibilities to just 256 possibilities per byte, mathematically exploiting the power leakage.
CPA CPA (Correlation Power Analysis): Correlation power analysis: a modern variant of DPA that refines the statistical approach even further. Instead of simply averaging and subtracting, the attacker assumes a model of what the chip's power consumption should look like for certain data (for example, that the current at a given moment depends on the number of bits set to 1 in an intermediate register). They then calculate the statistical correlation between the measured consumption and the consumption predicted by the model for thousands of candidate keys. The key that shows the highest correlation with reality is the most likely one. CPA is usually more effective and needs fewer traces than classic DPA, because it makes better use of the signal's magnitude information, not just the difference between two groups. Put simply, CPA is like using X-rays instead of photography: a more precise analysis of the relationship between the secret data and every small ripple in the power trace.
Timing Timing attacks: Power isn't the only thing that tells tales; the execution time of operations also gives away secrets. A pure timing attack consists of measuring how long the device takes to perform a given operation (for example, responding to an encryption request) and inferring internal data from variations in that time. If an algorithm takes a couple of microseconds longer when the key bit is 1 rather than 0, with enough measurements the entire key can be deduced. It was precisely by studying millisecond differences that Paul Kocher showed in 1996 that an RSA private key could be recovered; all it took was sending many operations and timing them. Timing attacks are conceptually simpler (who needs an oscilloscope when a stopwatch will do?), but their effectiveness depends on the software not being balanced. A careless developer who uses if/else in a cryptographic routine, or who doesn't equalize execution paths, opens the door for every microsecond of difference to be used against them. Today, "do everything in constant time" is a golden rule for protecting critical software, precisely because of this class of attack.
EM and indirect Indirect emissions (EM and others): A particularly cunning attacker doesn't even have to touch the circuit to spy on it. Every current flow generates a subtle electromagnetic field around it. With an electromagnetic emanation probe (a small antenna or coil close to the chip), you can capture practically the same information as by measuring power on the supply line. This is sometimes called DEMA (Differential Electromagnetic Analysis): applying DPA to EM signals instead of the power line. The advantage for the attacker is that they can spy "at a distance", without having to solder anything onto the board: by bringing a probe close to the running device, even a few centimeters away, they pick up the radio-frequency leakage produced by changes in current. In industrial environments, this would mean that someone with close physical access to a piece of equipment (without necessarily opening it) could capture traces of its emissions and, with patience, extract keys. Other indirect emissions include sound (yes, researchers have recovered keys by listening to the whine of voltage regulators or the clicking of components) and temperature. In practice, direct power measurement and EM are the most viable for hardware espionage, but they all share the same philosophy: exploiting any physical clue that slips through the cracks of a closed system.

The variants differ in the depth of the analysis and the type of signal they observe.

Real-world stories: high-voltage attacks

It may sound like something out of a cyber-spy novel, but these attacks are very real and have already exposed supposedly secure systems. In the late 1990s, for example, it was discovered that banking smart cards and payment chips were vulnerable: the PIN or authentication key could be extracted by analyzing power consumption over a handful of transactions. Pay-TV satellite companies suffered similar schemes: hackers with oscilloscopes cloned subscriber cards, bypassing the encryption that protected premium content. The automotive industry had its surprises too. KeeLoq, a proprietary cipher used in millions of wireless garage door openers and car alarm remotes, was completely broken in 2008 thanks to power analysis. Researchers showed how, with just 20 or 30 current measurements, they could recover a remote's secret key and clone the device. In some cases they even managed to derive the manufacturer's master key stored in the receiver (by taking additional traces), making it possible to build counterfeit remotes for multiple devices. All of this without depackaging the integrated circuit or brute-forcing the cipher, simply by listening to the electrical whispers that gave away each bit. The implications were serious: how many "secure" systems based on proprietary hardware might have been exposed without anyone knowing? The reality check was clear: even schemes that had withstood logical attacks could fall to a well-used oscilloscope.

In industrial and critical infrastructure environments, these side-channel attacks have moved from theory to practice in unsettling ways. Imagine a programmable logic controller (PLC) in a power plant that encrypts its communications to prevent unauthorized access. On paper, everything is secure. But if a malicious insider or an intruder with physical access covertly installs a current probe on the PLC's power cable, they could record traces while the PLC carries out encrypted exchanges. Later, by analyzing those traces, they could extract the cryptographic key used for the secure communication. With that key in hand, the attacker would have free rein to impersonate equipment, send malicious commands or decrypt sensitive data, all without raising suspicion, because they didn't exploit any typical "vulnerability": they simply eavesdropped on the controller's normal activity. Similar cases have been documented in the lab, from decoding the firmware of a microcontroller embedded in a SCADA system to cloning credentials stored in hardware security modules. The reality is that every device, from an electronic lock to an industrial IoT sensor, is subject to the laws of physics. And those laws can be turned against its security if no one has taken care to shield against them.

As an illustrative example, consider attacks on cryptocurrency hardware wallets. Several of these devices, famous for their security, have been put to the test with power analysis. In some cases, researchers managed to extract the PIN or the recovery phrase by measuring how power varied when the device checked a correct versus an incorrect password, in other words a hybrid timing/power attack. Once again it is clear: not even the elite of secure devices is immune when the side channel is open.

The electrical spy's lab: the equipment you need

Exploiting these vulnerabilities takes more lab coat than keyboard and mouse. What equipment do you need to play power hacker? Fortunately (or worryingly, depending on how you look at it), you don't need a CERN-grade electronics lab; a relatively affordable kit is enough to start extracting secrets:

Capture — Probes and shunt resistors
The first step is capturing the power signal. This is usually done by inserting a small resistor (shunt) in the target device's power supply line. As current flows through that resistor, it produces a voltage drop proportional to instantaneous consumption (Ohm's law in action). That voltage variation is the chip's "voice". Alternatively, you can use current probes (such as clamps or Hall-effect sensors) that measure the magnetic field created by the current without modifying the circuit. Even a simple coil near the chip can act as an antenna to pick up electromagnetic emissions from power activity. The choice depends on how much you can modify the device: in the lab you solder in a shunt; in the field, you might opt for a non-invasive probe.
Digitize — Oscilloscope or high-speed analyzer
Capturing that subtle signal with enough fidelity requires a fast instrument. Digital oscilloscopes of several hundred MS/s (megasamples per second) are the standard for power traces, since you have to record very brief changes during operations that may last microseconds or a few milliseconds. A good oscilloscope supports triggering to start capturing exactly when the event of interest occurs (for example, at the moment the chip receives a signal to start encrypting), so that the traces are aligned. There are also dedicated devices such as the well-known ChipWhisperer, an open platform designed specifically for side-channel attacks that combines a probe, a high-speed ADC and synchronization tools in a single kit. The crucial thing is to obtain a clean, reproducible trace: thousands of data points showing how the voltage fluctuates over time while the chip works. Each DPA/CPA experiment may require storing hundreds or thousands of these traces, so you sometimes end up handling gigabytes of raw data.
Analyze — Analysis software and plenty of statistics
Once the data is captured, the brainwork begins. This is where specialized software, or languages such as Python with scientific libraries, become the scalpel for opening up those waveforms and pulling out their secrets. There are commercial suites focused on SCA (side-channel analysis) that provide environments for importing traces and easily applying DPA/CPA algorithms. But you can perfectly well use free software and some code of your own: filter out high-frequency noise, align the traces (if synchronization wasn't perfect), and then apply statistical tests. For example, with a few lines of Python you can calculate the Pearson correlation between every point in the trace and a hypothetical power model for each possible subkey, essentially implementing a home-grown CPA. Visualization software is also useful for spotting trends, as are machine learning techniques for identifying subtle patterns. Bear in mind, though, that success is not instant, push-button "hacking": it usually involves trying different preprocessing approaches, modeling the chip's behavior (does it consume more according to the Hamming weight of the data, or according to bit transitions?), and adjusting the attack based on the results you get. It is an iterative process of statistics-assisted reverse engineering.
Expand — Other hardware add-ons
As you move up a level, a hardware hacking lab might include clock generators (to replace the device's clock and perhaps manipulate its speed), programmable power supplies (to inject voltage glitches, although that is more fault injection than side-channel) and EMC shielding to keep out external interference. Plus a stereo microscope and a steady hand if you need to solder ultra-fine wires onto complex boards. But for pure power analysis, the probe–oscilloscope–PC trio is usually enough. Remarkably, much of this fits in a backpack: security conferences have shown how a portable kit can perform DPA on site, which suggests a determined attacker could even operate from a van in the victim's parking lot, listening to devices without being seen.

The equipment is within reach of any security research team — or of a sufficiently motivated adversary.

In short, the equipment needed is within reach of any security research team (or sufficiently motivated adversary). It is no longer the exclusive domain of government agencies; today a pentester with a few thousand euros' worth of instruments can replicate attacks worthy of Mission: Impossible.

Limitations, countermeasures and the cat-and-mouse game

Of course, it's not all plain sailing for the attacker. Power analysis attacks have limitations, and there are mitigation techniques that defenders use to counter this silent threat:

Limitation Need for physical access or proximity: Unlike a conventional remote cyberattack, exploiting the power channel generally requires physical access to the device or, in the case of electromagnetic emissions, at least being very close to it. This usually means the attacker has to be an insider, have some time alone with the equipment, or temporarily steal the device to take it to their lab. In controlled environments, restricting physical access (locks, tamper-evident seals, secure enclosures) is the first line of defense. Many organizations protect their critical systems on the assumption that if nobody can touch them, nobody can listen to their signals. It isn't always foolproof, though: small devices can be stolen or swapped for instrumented clones, and in highly sensitive facilities there have been cases ranging from bribed employees to intruders who manage to plant concealed micro-probes.
Defense Variability and intentional noise: Hardware designers counter these attacks by trying to "silence" or blur the electrical trace. Ideally, a cryptographic operation should consume the same amount of power regardless of the data processed, so as not to give anything away. Achieving that is complex, but several techniques are used. One is to make all execution branches identical (for example, avoiding code branches that take different paths depending on a secret bit). Another is to add padding or "dummy" operations: even if the algorithm doesn't need them, the chip performs additional random computations so that apparent consumption is uniform, or at least chaotic and unpredictable. You can also introduce random delays: small random waits during the computation that desynchronize the traces, making them harder to average or align for DPA. And a classic technique is injecting noise into the power channel, for example by activating chip modules that draw power independently (such as noise sources or dummy loads) to mask the real variations. The goal of these strategies is that, even if the attacker obtains measurements, they find no consistent patterns to latch on to.
Defense Masking sensitive data: At the algorithmic level, an effective countermeasure is data masking. It consists of combining sensitive data with random values during intermediate operations, so that power consumption depends on a masked (and random) version of the data rather than the real data. For example, if you are going to compute S = SBOX[P ⊕ K] (a typical AES operation), you first generate a random number r and turn the operation into something like S' = SBOX[(P ⊕ r) ⊕ (K ⊕ f(r))], where f(r) is a corresponding transformation on the key. The final result S' is unmasked afterward, but for most of the computation what the attacker sees is consumption related to random values, not to the real key. Properly implemented, masking statistically reduces the exploitable correlation to almost zero, forcing the attacker to need vastly more traces or second-order attacks (much more complicated) to cancel out the effect of the random noise as well. That said, implementing masking correctly is hard and usually requires hardware randomizers on the chip.
Defense Resistant hardware design: Secure chip makers (smart cards, TPMs, HSMs) have spent years refining tricks to physically shield their components against eavesdropping. Some chips include internal voltage regulators and huge decoupling capacitors to smooth out any power spike, flattening the curve like a sedated heart. Others use dual-rail logic in antiphase: essentially two circuits performing the same operation but with inverted bit charging (where one draws more with a "1", the other draws more with a "0"), so that combined consumption is constant. There are also on-chip sensors that detect abnormal conditions: if someone drastically lowers the clock frequency (a technique sometimes used to make trace capture easier) or drops the temperature sharply to slow down the electronics, the system interprets it as an attack attempt and can wipe keys or lock functions. There are even epoxy packages and active meshes that trigger a memory wipe if tampered with (not directly anti-DPA, but it stops anyone from building a circuit on top of the chip). All of these measures add cost and complexity, but they are justified in products where defending against side-channel attacks is not optional. If a competitor or adversary could buy one of your devices and extract its master key in a lab, your security scheme collapses. That is why military-grade crypto chips look like miniature Fort Knoxes: their goal is to make any power analysis return useless data.
Defense Monitoring and operational limits: Another counterattack strategy works at the system level: detecting and limiting the number of sensitive operations that can be performed. If a cryptographic module notices, for example, that it has been asked to perform thousands of encryptions in an anomalous way, it could raise alerts or introduce extra delays. Likewise, external monitoring systems could measure a device's overall power consumption and detect suspicious patterns (although that is science fiction in most environments). In general, the idea is not to give the attacker unlimited opportunities to collect data. Many secure systems lock or reset after a certain number of failed attempts, which indirectly makes it harder to gather enough samples for DPA. It is a delicate balance, though: too strict and it can deny legitimate service; too lax and a patient attacker can take their time.

One real limitation and four countermeasures. The cat-and-mouse game goes on.

Despite all these defenses, the cat-and-mouse game goes on. Researchers come up with a new type of countermeasure, and others soon find ways around it with more refined attacks (for example, higher-order attacks that combine multiple leakage sources, or the use of artificial intelligence to pick signals out of the noise). Experience has shown that there is no such thing as perfect protection, only making the attack so costly and complex that it stops being practical. Even so, ignoring this class of threat is no longer an option: modern hardware security must be designed with side channels in mind, just as for years it has been designed on a foundation of mathematically sound cryptography.

In conclusion, power and timing analysis attacks remind us of a humbling but powerful lesson: security lies not only in code and mathematics, but also in the physics that executes them. Every device we design can betray us with a flicker of power or an extra tick of the clock. The good news is that, with awareness and smart design, we can make those electrical whispers much harder to interpret. The bad news is that, out there, someone will always be fine-tuning their hearing. As technical leaders in hardware and industrial cybersecurity, it is up to us to decide whether our devices will stay silent in front of the spy in the white coat, or keep whispering their secrets into the spy's ear. The future of hardware security will depend, to a large extent, on how well we can strike the balance between stealth and energy disclosure.

Topics

#Timing-Attacks #CPA-Correlation-Power-Analysis #Side-Channel #Countermeasures-and-Masking #DPA-Differential-Power-Analysis #Hacking-Hardware

Keep reading

Talk to us about OT security