[Paper Review] Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors

Yazhou Tu, Zhiqiang Lin+2 more|arXiv (Cornell University)|Jun 20, 2018

Modular Robots and Swarm IntelligenceEngineering47 citations

TL;DR

The paper analyzes non-invasive out-of-band acoustic injections to spoof embedded MEMS inertial sensors and deliver implicit control, introducing Side-Swing and Switching attacks and evaluating 25 devices.

ABSTRACT

Inertial sensors provide crucial feedback for control systems to determine motional status and make timely, automated decisions. Prior efforts tried to control the output of inertial sensors with acoustic signals. However, their approaches did not consider sample rate drifts in analog-to-digital converters as well as many other realistic factors. As a result, few attacks demonstrated effective control over inertial sensors embedded in real systems. This work studies the out-of-band signal injection methods to deliver adversarial control to embedded MEMS inertial sensors and evaluates consequent vulnerabilities exposed in control systems relying on them. Acoustic signals injected into inertial sensors are out-of-band analog signals. Consequently, slight sample rate drifts could be amplified and cause deviations in the frequency of digital signals. Such deviations result in fluctuating sensor output; nevertheless, we characterize two methods to control the output: digital amplitude adjusting and phase pacing. Based on our analysis, we devise non-invasive attacks to manipulate the sensor output as well as the derived inertial information to deceive control systems. We test 25 devices equipped with MEMS inertial sensors and find that 17 of them could be implicitly controlled by our attacks. Furthermore, we investigate the generalizability of our methods and show the possibility to manipulate the digital output through signals with relatively low frequencies in the sensing channel.

Motivation & Objective

• Motivate and assess the risk of non-invasive spoofing attacks on MEMS inertial sensors used in control systems.
• Characterize how out-of-band acoustic signals interact with ADC sampling to produce controllable digital outputs.
• Develop two attack paradigms (Side-Swing and Switching) to bias sensor readings in desired directions.
• Evaluate attack feasibility across a diverse set of real devices and elucidate factors affecting impact (sample rate drift, amplitude, phase).

Proposed method

• Model the digitization of out-of-band analog signals under undersampling and aliasing.
• Define and analyze how sample-rate drift amplifies frequency deviations in digitized outputs (Theorem 1).
• Introduce digital amplitude adjusting to shape the oscillating digitized signal (undersampling effects).
• Propose phase pacing via frequency changes to induce phase offsets and directional control.
• Describe two non-invasive attack methods (Side-Swing and Switching) that bias readings in target directions.
• Present an out-of-band signal injection model where V[i]=A[i]·sin(Φ[i]) and Φ[i] depends on ε and F_S.

Experimental results

Research questions

• RQ1 Can non-invasive acoustic injections reliably control embedded MEMS inertial sensors in real systems?
• RQ2 How do sample-rate drifts, undersampling, and phase effects enable manipulation of digital sensor outputs?
• RQ3 What are the practical attack strategies (Side-Swing, Switching) and their effectiveness across devices?
• RQ4 What is the scope of systems and actuations affected by such spoofing attacks?

Key findings

• Out of 25 tested devices, 17 could be implicitly controlled by acoustic attacks.
• 23 devices were affected by acoustic signals, with varying levels of control.
• 2 devices showed very limited susceptibility due to insufficient sound strength; 4 devices were vulnerable to DoS attacks; 2 devices were not affected.
• Gyro sensors yielded stronger adversarial control than accelerometers in the tested setups.
• Side-Swing attacks accumulate heading in the target direction by asymmetric amplitude modulation.
• Switching attacks achieve larger heading gains by repeatedly switching acoustic frequencies to induce phase pacing.