  Underwater datacenters (UDCs) hold promise as next-generation data storage
due to their energy efficiency and environmental sustainability benefits. While
the natural cooling properties of water save power, the isolated aquatic
environment and long-range sound propagation in water create unique
vulnerabilities which differ from those of on-land data centers. Our research
discovers the unique vulnerabilities of fault-tolerant storage devices,
resource allocation software, and distributed file systems to acoustic
injection attacks in UDCs. With a realistic testbed approximating UDC server
operations, we empirically characterize the capabilities of acoustic injection
underwater and find that an attacker can reduce fault-tolerant RAID 5 storage
system throughput by 17% up to 100%. Our closed-water analyses reveal that
attackers can (i) cause unresponsiveness and automatic node removal in a
distributed filesystem with only 2.4 minutes of sustained acoustic injection,
(ii) induce a distributed database's latency to increase by up to 92.7% to
reduce system reliability, and (iii) induce load-balance managers to redirect
up to 74% of resources to a target server to cause overload or force resource
colocation. Furthermore, we perform open-water experiments in a lake and find
that an attacker can cause controlled throughput degradation at a maximum
allowable distance of 6.35 m using a commercial speaker. We also investigate
and discuss the effectiveness of standard defenses against acoustic injection
attacks. Finally, we formulate a novel machine learning-based detection system
that reaches 0% False Positive Rate and 98.2% True Positive Rate trained on our
dataset of profiled hard disk drives under 30-second FIO benchmark execution.
With this work, we aim to help manufacturers proactively protect UDCs against
acoustic injection attacks and ensure the security of subsea computing
infrastructures.
