Attacking Electric Motors for Fun and Profit
summary
A reusable seven‑layer motor threat model maps attacks against operator, sensor, control, drive, power, motor and load. Experiments use a hackRF One to seize a 27 MHz RC link, Raspberry Pi GPIO/pigpio remote to flip PWM between 30–40% and hijack RPM, I2C spoofing of an ATXL345 accelerometer, hardware implants that take over the PWM pin, memory‑map register rootkits, reprogrammed digital servos, a 12 V electromagnet that raises RPM ~3–4%, and a fan burned out in 61 minutes at ~180°C.
AI-written summary · about
chapters (43)
- 0:00Intro
- 0:30Welcome
- 0:49Introduction
- 1:18Overview
- 1:59Safety Warning
- 3:18Safety Controls
- 4:14Security Risks
- 4:55Recommendations
- 5:05Inside the System
- 5:51Thoughts
- 6:30How Electric Motors Work
- 8:14Datasheets
- 9:02Control Theory
- 9:45Security Problem
- 11:13Common Attacks
- 12:56Motor Threat Model
- 13:49Layers
- 15:26Attack Objectives
- 18:50Physical Attacks
- 20:03Remote Control Car
- 21:16Remote Pin Control
- 23:57Output Speed Graph
- 24:44Sensor Layer
- 25:55I2C
- 26:38Disrupter Jam
- 27:28Single Command Injection
- 29:27Second Control Attack
- 30:01Wiring
- 31:11Results
- 31:53Drive Layer
- 32:52First Drive Layer Attack
- 33:33Second Drive Layer Attack
- 37:04Low Voltage
- 37:28Motor Layer
- 38:55Digital Servo
- 40:34Low Layer
- 42:09Summary
- 42:37Scenario
- 43:02Attackers
- 43:58Refine Goals
- 46:12Boneyard
- 46:26Takeaways
- 47:11Thanks
related talks
40mWearable Botnets and Happy Hacked Drivers
17mHotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...
44m"Attacking industrial remote controllers for fun and profit"
30mAffordable EMFI Attacks Against Modern IoT Chips
37mHacking a Cat — Going Beyond Traditional Attack Vectors
38mAbusing CNC Technologies
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
31mHacking Everything – The Dark Side of the Internet of Things