Latest ARM processors are approaching the computational power of x86 architectures while consuming much less energy. Consequently, supply follows demand with Amazon EC2, Equinix Metal and Microsoft Azure offering ARM-based instances, while Oracle Cloud Infrastructure is about to add such support. We expect this trend to continue, with an increasing number of cloud providers offering ARM-based cloud instances. ARM processors are more energy-efficient leading to substantial electricity savings for cloud providers. However, a malicious cloud provider could intentionally reduce the CPU voltage to further lower its costs. Running applications malfunction when the undervolting goes below critical thresholds. By avoiding critical voltage regions, a cloud provider can run undervolted instances in a stealthy manner. This practical experience report describes a novel attack scenario: an attack launched by the cloud provider against its users to aggressively reduce the processor voltage for saving energy to the last penny. We call it the Scrooge Attack and show how it could be executed using ARM-based computing instances. We mimic ARM-based cloud instances by deploying our own ARM-based devices using different generations of Raspberry Pi. Using realistic and synthetic workloads, we demonstrate to which degree of aggressiveness the attack is relevant. The attack is unnoticeable by our detection method up to an offset of -50mV. We show that the attack may even remain completely stealthy for certain workloads. Finally, we propose a set of client-based detection methods that can identify undervolted instances. We support experimental reproducibility and provide instructions to reproduce our results.
翻译：最新ARM处理器正在接近x86建筑的计算力,同时消耗的能源要少得多。 因此,亚马逊EC2、Equinix Metal和微软 Azure的供货需求随亚马逊EC2、Equinix Metal和微软 Azure的供货需求而变化,提供ARM的事例,而甲骨文云基础设施则即将增加这种支持。 我们预计这一趋势将继续下去,越来越多的云提供商提供ARM的云源。 ARM处理器的能效更高,为云提供大量电力节约。 但是,恶意云提供商可能会故意降低CPU的电压,以进一步降低其成本。 当低压在临界阈值下运行应用程序时,应用规则会发生故障。 通过避免临界电压区域,云提供商可以以隐蔽的方式运行低变幻事件。 这份实际的经验报告描述了一种新的攻击情景:云提供商对其用户发动攻击,以大幅降低将能源节省到最后的电费。 我们称之为Scrooooge a 攻击, 并显示如何使用基于AR-revort com的计算,我们甚至可以使用以隐性攻击的计算方法来进行我们的ARM-reval 抵消攻击。