skip to main content
US FlagAn official website of the United States government
dot gov icon
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
https lock icon
Secure .gov websites use HTTPS
A lock ( lock ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.


Title: Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
Inertial sensors provide crucial feedback for control systems to determine motional status and make timely, automated decisions. Prior efforts tried to control the output of inertial sensors with acoustic signals. However, their approaches did not consider sample rate drifts in analog-to-digital converters as well as many other realistic factors. As a result, few attacks demonstrated effective control over inertial sensors embedded in real systems. This work studies the out-of-band signal injection methods to deliver adversarial control to embedded MEMS inertial sensors and evaluates consequent vulnerabilities exposed in control systems relying on them. Acoustic signals injected into inertial sensors are out-of-band analog signals. Consequently, slight sample rate drifts could be amplified and cause deviations in the frequency of digital signals. Such deviations result in fluctuating sensor output; nevertheless, we characterize two methods to control the output: digital amplitude adjusting and phase pacing. Based on our analysis, we devise non-invasive attacks to manipulate the sensor output as well as the derived inertial information to deceive control systems. We test 25 devices equipped with MEMS inertial sensors and find that 17 of them could be implicitly controlled by our attacks. Furthermore, we investigate the generalizability of our methods and show the possibility to manipulate the digital output through signals with relatively low frequencies in the sensing channel.  more » « less
Award ID(s):
1812553
PAR ID:
10454063
Author(s) / Creator(s):
; ; ;
Date Published:
Journal Name:
27th USENIX Security Symposium
Page Range / eLocation ID:
1545-1562
Format(s):
Medium: X
Sponsoring Org:
National Science Foundation
More Like this
  1. null (Ed.)
    The goal of this paper is to provide a novel computing approach that can be used to reduce the power consumption, size, and cost of wearable electronics. To achieve this goal, the use of microelectromechanical systems (MEMS) sensors for simultaneous sensing and computing is introduced. Specifically, by enabling sensing and computing locally at the MEMS sensor node and utilizing the usually unwanted pull in/out hysteresis, we may eliminate the need for cloud computing and reduce the use of analog-to-digital converters, sampling circuits, and digital processors. As a proof of concept, we show that a simulation model of a network of three commercially available MEMS accelerometers can classify a train of square and triangular acceleration signals inherently using pull-in and release hysteresis. Furthermore, we develop and fabricate a network with finger arrays of parallel plate actuators to facilitate coupling between MEMS devices in the network using actuating assemblies and biasing assemblies, thus bypassing the previously reported coupling challenge in MEMS neural networks. 
    more » « less
  2. Temperature sensing and control systems are widely used in the closed-loop control of critical processes such as maintaining the thermal stability of patients, or in alarm systems for detecting temperature-related hazards. However, the security of these systems has yet to be completely explored, leaving potential attack surfaces that can be exploited to take control over critical systems. In this paper we investigate the reliability of temperature-based control systems from a security and safety perspective. We show how unexpected consequences and safety risks can be induced by physical-level attacks on analog temperature sensing components. For instance, we demonstrate that an adversary could remotely manipulate the temperature sensor measurements of an infant incubator to cause potential safety issues, without tampering with the victim system or triggering automatic temperature alarms. This attack exploits the unintended rectification effect that can be induced in operational and instrumentation amplifiers to control the sensor output, tricking the internal control loop of the victim system to heat up or cool down. Furthermore, we show how the exploit of this hardware-level vulnerability could affect different classes of analog sensors that share similar signal conditioning processes. Our experimental results indicate that conventional defenses commonly deployed in these systems are not sufficient to mitigate the threat, so we propose a prototype design of a low-cost anomaly detector for critical applications to ensure the integrity of temperature sensor signals. 
    more » « less
  3. null (Ed.)
    Abstract The size and power limitations in small electronic systems such as wearable devices limit their potential. Significant energy is lost utilizing current computational schemes in processes such as analog-to-digital conversion and wireless communication for cloud computing. Edge computing, where information is processed near the data sources, was shown to significantly enhance the performance of computational systems and reduce their power consumption. In this work, we push computation directly into the sensory node by presenting the use of an array of electrostatic Microelectromechanical systems (MEMS) sensors to perform colocalized sensing-and-computing. The MEMS network is operated around the pull-in regime to access the instability jump and the hysteresis available in this regime. Within this regime, the MEMS network is capable of emulating the response of the continuous-time recurrent neural network (CTRNN) computational scheme. The network is shown to be successful at classifying a quasi-static input acceleration waveform into square or triangle signals in the absence of digital processors. Our results show that the MEMS may be a viable solution for edge computing implementation without the need for digital electronics or micro-processors. Moreover, our results can be used as a basis for the development of new types of specialized MEMS sensors (ex: gesture recognition sensors). 
    more » « less
  4. null (Ed.)
    This paper presents a review of state-of-the-art micro-electro-mechanical-systems (MEMS) acoustic emission (AE) sensors. MEMS AE sensors are designed to detect active defects in materials with the transduction mechanisms of piezoresistivity, capacitance or piezoelectricity. The majority of MEMS AE sensors are designed as resonators to improve the signal-to-noise ratio. The fundamental design variables of MEMS AE sensors include resonant frequency, bandwidth/quality factor and sensitivity. Micromachining methods have the flexibility to tune the sensor frequency to a particular range, which is important, as the frequency of AE signal depends on defect modes, constitutive properties and structural composition. This paper summarizes the properties of MEMS AE sensors, their design specifications and applications for detecting the simulated and real AE sources and discusses the future outlook. 
    more » « less
  5. Fabrication and acoustic performance of a microelectromechanical systems (MEMS) microphone are presented. The microphone utilizes an unusual electrostatic sensing scheme that causes the sensing electrode to move away, or levitate from the biasing electrode as the bias voltage is applied. This approach differs from existing electrostatic sensors and completely avoids the usual collapse, or pull-in instability. In this study, our goal is to fabricate a MEMS microphone whose sensitivity could be improved simply by increasing the bias voltage, without suffering from pull-in instability. The microphone is tested in our anechoic chamber and a read-out circuit is used to obtain electrical signals in response to sound pressure at various bias voltages. Experimental results show that the sensitivity increases approximately linearly with bias voltage for bias voltages from 40 volts to 100 volts. The ability to design electrostatic sensors without concerns about pull-in failure can enable a wide-range of promising sensor designs. 
    more » « less