SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND

Size: px

Start display at page:

Download "SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND"

Gordon Chase
5 years ago
Views:

1 SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND

2 Authors Wang, Zhengbo & Wang, Kang Alibaba Security Yang, Bo CAICT Li, Shangyuan Tsinghua University Pan, Aimin Alibaba Security

3 About us - Who are we: A research team of Alibaba security. - Our research interests: Security issues about IoT, AI and their combinations. - Previous briefing: GPS spoofing (Blackhat Europe 2015)

4 Outline An attack demo of Oculus headset Dig deeper on MEMS Other attack attempts on VR devices Attack attempts on drones Attack attempts on self-balanced vehicles 3 Countermeasures The END

5 Attack Demo on Facebook Oculus

6 How This Happens?

7 What is MEMS

8 What is MEMS

9 How MEMS Works Accelerometer

10 How MEMS Works Accelerometer Springs Sensing Mass Capacitor

11 How MEMS Works Accelerometer C C C C m 1 DoF (Degree of Freedom) Spring-Mass System

12 How MEMS Works Accelerometer C C C C

13 How MEMS Works Accelerometer C C C C

14 How MEMS Works Accelerometer acc acc m

15 How to Attack Resonance m

16 Previous Work T. Trippel et al. WALNUT.

17 How MEMS Works Gyroscope m m cosω0t No Rotation 2 DoF (Degree of Freedom) Spring-Mass System m

18 How MEMS Works Gyroscope D:displacement m m cosω0t Rotation D = A cos ω0t A > 0 : clockwise rotation A < 0 : counter clockwise m

19 Coriolis Force Gyroscope Fc = 2mv W Fc Coriolis force m vibratory mass v linear velocity W - angular rotation

20 How to Attack Gyroscope 0< <π A>0 pi < < 2π A<0

21 How to Attack Gyroscope :0 π

22 Modulation Demo

23 Attack Attempts VR Devices(including Phones) Facebook Oculus Rift CV1 HTC Vive + Controller Microsoft HoloLens iphone 7 Samsung Galaxy S7 Drone DJI phantom 3 Self Balancing Vehicles(including Toys) DIY balancing robot Mi Mitu toy robot Mi Ninebot Mini

24 HTC Vive HTC Vive Headset

26 No detailed tear-down Pictures.

27 Video Demo: Samsung S7 Unknown chips Position near rear cam

28 Video Demo: iphone 7 Unknown chip

29 DJI Phantom 3 Standard MP65 L1508

30 DJI Phantom 3 Standard - Camera Unknown chips

31 DIY Self-balancing Robot MPU6050 module

32 MiTu Self-balancing Robot Unknown chip

33 Commerical Scooter Unknown chip

34 Commerical Scooter Without PA With PA

35 What about real car??

36 BOM Device Model Price Signal Genenerator FA20 Max Freq: 20MHz (>> 30kHz) Max Ampl: 20Vpp $320 Ultrasound Emitter 2425 $0.4 Amplifier TDA8932 $2 DC Power LRS $10 Signal Generator UTG9002C Max Freq: 2MHz Max Ampl: 25Vpp $16

37 MEMS and Security: An inexhaustive list Gyroscope Accelerometer Other MEMS* DoS Son, et al. Trippel, et al. TODO Manipulation This work! Trippel, et al. TODO Long Range TODO TODO TODO * Other MEMS chips include MEMS microphones, barometers, digital micromirror display and so on.

38 Countermeasures 1. Shell - prevent sonic energy from intruding. - reflective material with multilayer may be considered. 2. Software - actively detect the resonating sound with microphone. - warn or perform noise cancelling. 3. Chip - new design of MEMS chips that can resist sonic attacks*. *Serrano D E, et al. PLANS, 2016.

39 References Man, Kin F. "MEMS reliability for space applications by elimination of potential failure modes through testing and analysis." MEMS Reliability for Critical and Space Applications. Vol Dean, Robert N., et al. "On the degradation of MEMS gyroscope performance in the presence of high power acoustic noise." Industrial Electronics, ISIE IEEE International Symposium on. IEEE, Castro, Simon, et al. "Influence of acoustic noise on the dynamic performance of MEMS gyroscopes." ASME 2007 International Mechanical Engineering Congress and Exposition. American Society of Mechanical Engineers, Son, Yunmok, et al. "Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors." USENIX Security Trippel,Timothy, et al. "WALNUT: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks." In Proceedings of the 2nd IEEE European Symposium on Security and Privacy (Euro S&P 2017). To appear. Mikko Saukoski. System and circuit design for a capacitive mems gyroscope, Doctoral Dissertation, Serrano D E, et al. Environmentally-robust high-performance tri-axial bulk acoustic wave gyroscopes. Position, Location and Navigation Symposium (PLANS), Acknowledgement Sun, Yinan - Tsinghua University

40 Q&A

41 Thank you.

SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND

SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND Authors Wang, Zhengbo & Wang, Kang Alibaba Security Yang, Bo CAICT Li, Shangyuan Tsinghua University Pan, Aimin Alibaba Security