FanBleed: Stealing Your Secrets via Observing Your Cooling Fan

In this paper, we introduce a new physical sidechannel attack vector named FanBleed that exploits the CPU cooling fan's mechanical movements to infer sensitive information about ongoing computational activities. We show that an attacker can use an off-the-shelf mmWave radar to precisely measure the fan's rotational speed variations, which strongly correlate with the CPU's power consumption and temperature changes induced by different workloads. We investigate the root causes of FanBleed and uncover its instruction- and data-dependent nature. Similar to power side channels, FanBleed can leak coarse-grained information suitable for website fingerprinting. Moreover, we discover that the fan speed transition timings leak fine-grained information about power and thermal throttling events, enabling the recovery of cryptographic keys. We demonstrate the real-world impacts of FanBleed through two case studies: a website fingerprinting attack and a cryptanalytic attack targeting the SIKE secret key. Our work highlights the CPU cooling fan as a widely available and unexplored side channel, urging the need to assess its security implications and develop effective countermeasures against FanBleed-like attacks.