Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
summary
Presents a practical black‑box attack that uses acoustic and vibration signals to spoof MEMS inertial outputs by exploiting a sample rate drift amplification theorem and two control methods: digital amplitude adjusting and phase pacing. Uses a function generator, 50 V amplifier, horns and focused speakers (110–130 dB), plus an automated program that reads phone inertial APIs with no permission to modulate signals. Tests 25 devices and finds 17 susceptible, manipulates motors, self‑balancing transporters, 3D mice, map/VR orientation, and even creates large false accelerations at ~20 Hz.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:06Acoustic Attacks on MEMS Inertial Sensors
- 1:54White-box approach
- 2:36Motivation: A Real System is often a Black Box
- 4:35Acoustic Injection
- 5:27Amplification Effects of Sample Rate Drifts
- 6:07Sample Rate Drifts Amplification Theorem
- 6:40Digital Amplitude Adjusting
- 8:07Phase Pacing
- 8:56Switching Attacks
- 9:30Challenges in the Black-box Approach
- 10:04Reverse Signal Mapping
- 10:31Experimental Setup
- 11:24Closed-loop Control Systems
- 13:03Open-loop Control Systems
- 14:20Automatic Switching Attack with Feedback
- 15:34Implementations of Automatic Attacks
- 16:28Generalization: Using Non-resonant Frequencies
- 17:15Possible Mitigation Methods
related talks
30mThe Motion Sensor Western: The Good, the Bad, and the Ugly
26mLegal GNSS Spoofing and its Effects on Autonomous Vehicles
09mWIP: Hijacking Attacks on UAV Follow-Me Systems in Realistic Scenarios
17mConfuSense: Sensor Reconfiguration Attacks for Stealthy UAV Manipulation
06mAnti-Spoofing Voice Commands: A Generic Wireless Assisted Design
25mBiometric Authentication Under Threat: Liveness Detection Hacking
13mBlind Spot in Sensor Fusion: Exploiting an Architectural Vulnerability to Hijack...
01h 06mSelf-Driving and Connected Cars: Fooling Sensors and Tracking Drivers