  Power analysis is a class of side-channel attacks, where power consumption
data is used to infer sensitive information and extract secrets from a system.
Traditionally, such attacks required physical access to the target, as well as
specialized devices to measure the power consumption with enough precision. The
PLATYPUS attack has shown that on-chip power meter capabilities exposed to a
software interface might form a new class of power side-channel attacks. This
paper presents a software-based power side-channel attack on Apple Silicon
M1/M2 platforms, exploiting the System Management Controller (SMC) and its
power-related keys, which provides access to the on-chip power meters through a
software interface to user space software. We observed data-dependent power
consumption reporting from such keys and analyzed the correlations between the
power consumption and the processed data. Our work also demonstrated how an
unprivileged user mode application successfully recovers bytes from an AES
encryption key from a cryptographic service supported by a kernel mode driver
in macOS. Furthermore, we discuss the impact of software-based power
side-channels in the industry, possible countermeasures, and the overall
implications of software interfaces for modern on-chip power management
systems.
