Temperature sensing and control systems are widely used in the closed-loop control of critical processes such as maintaining the thermal stability of patients, or in alarm systems for detecting temperature-related hazards. However, the security of these systems has yet to be completely explored, leaving potential attack surfaces that can be exploited to take control over critical systems.
In this paper we investigate the reliability of temperature-based control systems from a security and safety perspective. We show how unexpected consequences and safety risks can be induced by physical-level attacks on analog temperature sensing components. For instance, we demonstrate that an adversary could remotely manipulate the temperature sensor measurements of an infant incubator to cause potential safety issues, without tampering with the victim system or triggering automatic temperature alarms. This attack exploits the unintended rectification effect that can be induced in operational and instrumentation amplifiers to control the sensor output, tricking the internal control loop of the victim system to heat up or cool down. Furthermore, we show how the exploit of this hardware-level vulnerability could affect different classes of analog sensors that share similar signal conditioning processes.
Our experimental results indicate that conventional defenses commonly deployed in these systems are not sufficient to mitigate the threat, so we propose a prototype design of a low-cost anomaly detector for critical applications to ensure the integrity of temperature sensor signals.
more »
« less
Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
Inertial sensors provide crucial feedback for control systems to determine motional status and make timely, automated decisions. Prior efforts tried to control the output of inertial sensors with acoustic signals. However, their approaches did not consider sample rate drifts in analog-to-digital converters as well as many other realistic factors. As a result, few attacks demonstrated effective control over inertial sensors embedded in real systems.
This work studies the out-of-band signal injection methods to deliver adversarial control to embedded MEMS inertial sensors and evaluates consequent vulnerabilities exposed in control systems relying on them. Acoustic signals injected into inertial sensors are out-of-band analog signals. Consequently, slight sample rate drifts could be amplified and cause deviations in the frequency of digital signals. Such deviations result in fluctuating sensor output; nevertheless, we characterize two methods to control the output: digital amplitude adjusting and phase pacing. Based on our analysis, we devise non-invasive attacks to manipulate the sensor output as well as the derived inertial information to deceive control systems. We test 25 devices equipped with MEMS inertial sensors and find that 17 of them could be implicitly controlled by our attacks. Furthermore, we investigate the generalizability of our methods and show the possibility to manipulate the digital output through signals with relatively low frequencies in the sensing channel.
more »
« less
- Award ID(s):
- 1812553
- NSF-PAR ID:
- 10454063
- Date Published:
- Journal Name:
- 27th USENIX Security Symposium
- Page Range / eLocation ID:
- 1545-1562
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
null (Ed.)The goal of this paper is to provide a novel computing approach that can be used to reduce the power consumption, size, and cost of wearable electronics. To achieve this goal, the use of microelectromechanical systems (MEMS) sensors for simultaneous sensing and computing is introduced. Specifically, by enabling sensing and computing locally at the MEMS sensor node and utilizing the usually unwanted pull in/out hysteresis, we may eliminate the need for cloud computing and reduce the use of analog-to-digital converters, sampling circuits, and digital processors. As a proof of concept, we show that a simulation model of a network of three commercially available MEMS accelerometers can classify a train of square and triangular acceleration signals inherently using pull-in and release hysteresis. Furthermore, we develop and fabricate a network with finger arrays of parallel plate actuators to facilitate coupling between MEMS devices in the network using actuating assemblies and biasing assemblies, thus bypassing the previously reported coupling challenge in MEMS neural networks.more » « less
-
Fabrication and acoustic performance of a microelectromechanical systems (MEMS) microphone are presented. The microphone utilizes an unusual electrostatic sensing scheme that causes the sensing electrode to move away, or levitate from the biasing electrode as the bias voltage is applied. This approach differs from existing electrostatic sensors and completely avoids the usual collapse, or pull-in instability. In this study, our goal is to fabricate a MEMS microphone whose sensitivity could be improved simply by increasing the bias voltage, without suffering from pull-in instability. The microphone is tested in our anechoic chamber and a read-out circuit is used to obtain electrical signals in response to sound pressure at various bias voltages. Experimental results show that the sensitivity increases approximately linearly with bias voltage for bias voltages from 40 volts to 100 volts. The ability to design electrostatic sensors without concerns about pull-in failure can enable a wide-range of promising sensor designs.more » « less
-
Easily establishing pairing between Internet-of-Things (IoT) devices is important for fast deployment in many smart home scenarios. Traditional pairing methods, including passkey, QR code, and RFID, often require specific user interfaces, surface’s shape/material, or additional tags/readers. The growing number of low-resource IoT devices without an interface may not meet these requirements, which makes their pairing a challenge. On the other hand, these devices often already have sensors embedded for sensing tasks, such as inertial sensors. These sensors can be used for limited user interaction with the devices, but are not suitable for pairing on their own. In this paper, we present UniverSense, an alternative pairing method between low-resource IoT devices with an inertial sensor and a more powerful networked device equipped with a camera. To establish pairing between them, the user moves the low-resource IoT device in front of the camera. Both the camera and the on-device sensors capture the physical motion of the low-resource device. UniverSense converts these signals into a common state-space to generate fingerprints for pairing. We conduct real-world experiments to evaluate UniverSense and it achieves an F1 score of 99.9% in experiments carried out by five participants.more » « less
-
null (Ed.)more » « less
Abstract The size and power limitations in small electronic systems such as wearable devices limit their potential. Significant energy is lost utilizing current computational schemes in processes such as analog-to-digital conversion and wireless communication for cloud computing. Edge computing, where information is processed near the data sources, was shown to significantly enhance the performance of computational systems and reduce their power consumption. In this work, we push computation directly into the sensory node by presenting the use of an array of electrostatic Microelectromechanical systems (MEMS) sensors to perform colocalized sensing-and-computing. The MEMS network is operated around the pull-in regime to access the instability jump and the hysteresis available in this regime. Within this regime, the MEMS network is capable of emulating the response of the continuous-time recurrent neural network (CTRNN) computational scheme. The network is shown to be successful at classifying a quasi-static input acceleration waveform into square or triangle signals in the absence of digital processors. Our results show that the MEMS may be a viable solution for edge computing implementation without the need for digital electronics or micro-processors. Moreover, our results can be used as a basis for the development of new types of specialized MEMS sensors (ex: gesture recognition sensors).
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- The DOI is not currently available.
