Technology · Research Library

Power Line Exfiltration: the published record

Power line exfiltration is not a vendor claim. It is a documented class of covert channel, demonstrated in peer-reviewed and preprint research over the past decade. The papers below establish the threat in the researchers' own words. We host them here so security and compliance teams can read the primary sources directly.

4 papers
2018 – 2020
Air-gap covert channels

Compliant is not the same as quiet

Regulatory conducted-emission limits for equipment begin at 150 kHz. The conducted channel demonstrated in PowerHammer operates below 24 kHz. A power supply can pass certification and still carry the signal, because the signal lives beneath the band the rules cover.

Source: PowerHammer, §II and §VII. FCC Part 15 governs conducted emissions in the 150 kHz – 30 MHz range (450 kHz – 30 MHz for some device classes).

A decade of air-gap covert channel research

Power line exfiltration sits inside an established research lineage. The same academic groups have shown data escaping isolated computers through many physical paths. The conducted power-line channel is one branch of that tree.

Channels catalogued in PowerHammer, Table I. Highlighted entries are the four papers in this library.

The papers

Only one of these, PowerHammer, describes a conducted power-line channel, the path Bantam hardware addresses. The other three show the same CPU-load mechanism escaping by magnetic and near-field radiated paths. Together they describe the landscape a serious isolation policy has to account for.

What the researchers recommend

The countermeasure sections of these papers, written independently of any vendor, point toward the same physical-layer defenses.

How much leaves at these rates?

The bit rates in these papers sound small. Set a payload and a demonstrated channel to see how long a covert transfer actually takes.

What is leaving
Encryption key128 bits
Password12 chars
Credential file1 KB
Small document256 KB
Demonstrated channel
PowerHammer, line1000 bit/s
PowerHammer, panel10 bit/s
ODINI, magnetic40 bit/s
Powermitter, coil2 bit/s
1.0 s

Idealized: payload bits divided by demonstrated bit rate, framing and error correction excluded. Rates are the figures reported in the cited papers.

Where Bantam fits

Of the channels above, the conducted power-line path is the one addressed by point-of-use power conditioning. Our technology supports the physical-layer controls these researchers describe, and it maps to NIST SP 800-53 PE-19, information leakage. See the Power Line Exfiltration overview for how the Bantam circuit relates to the conducted channel, and Patents & Certifications for listings and marking.

These documents are provided for research and educational reference. Preprint versions are hosted here; where a paper was later published in a journal, the link resolves to the publisher of record.