SONIC GUN TO SMART DEVICESYOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND

Authors
Wang, Zhengbo & Wang, Kang
Alibaba Security

Yang, BoCAICTLi, Shangyuan
Tsinghua University

Pan, Aimin
Alibaba Security

About Us- Who are we:
A research team of Alibaba security.
- Our research interests:
Security issues about IoT, AI and their combinations.
- Previous briefing:
Time and Position Spoofing with Open Source Projects
Blackhat Europe 2015

Outline- An attack demo of Oculus headset- Physical Principle of MEMS
- Other attack attempts on VR devices- Attack attempts on drones- Attack attempts on self-balanced vehicles - Countermeasures

Attack Demo on Facebook Oculus

How This Happens?

Photo from ifixit.com

What is MEMS
Micro Electro-Mechanical Systems

What is MEMS

How MEMS Works
Accelerometer

How MEMS Works
Accelerometer

Springs

Sensing Mass

Capacitor

How MEMS Works
Accelerometer
CCCCm

1 DoF (Degree of Freedom)
Spring-Mass System

How MEMS Works
AccelerometerC↓C↑C↓C↑

How MEMS Works
AccelerometerC↑C↓C↑C↓

How MEMS Works
AccelerometerC↓C↑C↓C↑

How MEMS Works
AccelerometerC↑C↓C↑C↓How MEMS Works
Accelerometeraccaccm

How to AttackResonancemPrevious WorkT. Trippel, et al. EuroS&P, 2017.

How MEMS Works
GyroscopeHow MEMS Works
GyroscopeHow MEMS Works
Gyroscopemm
cosω0tNo Rotation
2 DoF (Degree of Freedom)
Spring-Mass Systemm

How MEMS Works
Gyroscopemm
cosω0tD:displacementRotation

D = A cos ω0t
A > 0 : clockwise rotation
A < 0 : counter clockwisemHow MEMS Works
Gyroscope
Fc = 2mv×W
Fc - Coriolis forcem - vibratory massv - linear velocityW - angular rotation

WHow MEMS Works
Gyroscope
Fc = 2mv×W
Fc - Coriolis forcem - vibratory massv - linear velocity
W - angular rotation

How MEMS Works
D:displacementmm
cosω0tm

Nornal Output:Rotation
OUT = LPF{2 D cos ω0t}
= LPF{2 A cos ω0t cos ω0t}
= LPF{A + A cos 2ω0t}=AHow to Attack
Gyroscope
Displacement Under Attack:D = Au cos(ωut + ΔΦ)Au : ultrasound induced amplitude
ωu : ultrasound frequency
ΔΦ : ultrasound phase shift

Attack Output:OUT = LPF{2 D cos ω0t}
= LPF{Au cos [(ω0-ωu)t - ΔΦ] + Au cos [(ω0+ωu)t + ΔΦ]}= Au cos [(ω0-ωu)t - ΔΦ]How to Attack
Gyroscope0<<πOUT > 0pi << 2π
OUT < 0How to Attack
Gyroscope:0πModulation Demo
11100100

This work.

11 0 0 0

1 0 1 ...

B. Farshteindiker, WOOT, 2016

Attack Attempts
VR Devices(including Phones)
Facebook Oculus Rift CV1
HTC Vive + Controller
Microsoft HoloLens
iPhone 7
Samsung Galaxy S7Drone
DJI phantom 3
Self Balancing Vehicles(including Toys)
DIY balancing robot
Mi Mitu toy robot
Mi Ninebot Mini

HTC Vive•HTC Vive Headset

HTC Vive ControllerController

MEMS Chip

HoloLens

Video Demo: Samsung S7
STMicroelectronics LSM6DS3
MEMS Chip

Video Demo: iPhone 7

InvenSense 773C

Video Demo: iPhone 7

with Doppler Frequency ShiftDJI Phantom 3 Standard

MP65
L1508

DJI Phantom 3 Standard - Camera

MPU6050 module

DIY Self-balancing Robot

Acknowledgement: Resonating frequency first found by T. Trippel, et al. EuroS&P, 2017.

MiTu Self-balancing Robot

Commerical ScooterCommerical Scooter

Without Power Amplifier

With Power Amplifier

What about real car?

?

MEMS and Security: An inexhaustive list
Gyroscope

Accelerometer

Other MEMS*DoSSon, et al.

Trippel, et al.

TODOManipulation

This work!

Trippel, et al.

TODOLong Range

TODO

TODO

TODO

* Other MEMS chips include MEMS microphones, barometers, digital micromirror display and soon.

Countermeasures
1. Shell- prevent sonic energy from intruding.
- reflective material with multilayer may be considered.
2. Software- actively detect the resonating sound with microphone.
- warn or perform noise cancelling.
3. Chip- new design of MEMS chips that can resist sonic attacks*.
4. Multi Sensors*Serrano D E, et al. PLANS, 2016.

BOM
DeviceModelPrice

Signal Genenerator

SP F20A
Max Freq: 20MHz (>> 30kHz)
Max Ampl: 20Vpp$320

Ultrasound Emitter

2425

$0.4

Amplifier

TDA8932$2

DC Power

LRS-100-24$10Signal Generator(Cheaper one)

UTG9002C
Max Freq: 2MHz
Max Ampl: 25Vpp$16

References
1.
2.
3.
4.
5.
6.
7.
8.

Man, Kin F. "MEMS reliability for space applications by elimination of potential failure modes through testing andanalysis." MEMS Reliability for Critical and Space Applications. Vol. 3880. 1999.
Dean, Robert N., et al. "On the degradation of MEMS gyroscope performance in the presence of high power acousticnoise." Industrial Electronics, 2007. ISIE 2007. IEEE International Symposium on. IEEE, 2007.
Castro, Simon, et al. "Influence of acoustic noise on the dynamic performance of MEMS gyroscopes." ASME 2007
International Mechanical Engineering Congress and Exposition. American Society of Mechanical Engineers, 2007.
Son, Yunmok, et al. "Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors." USENIX Security. 2015.
Trippel, Timothy, et al. "WALNUT: Waging doubt on the integrity of mems accelerometers with acoustic injection
attacks." IEEE European Symposium on Security and Privacy, 2017.
Mikko Saukoski. System and circuit design for a capacitive mems gyroscope, Doctoral Dissertation, 2008.
Serrano D E, et al. Environmentally-robust high-performance tri-axial bulk acoustic wave gyroscopes. Position,Location and Navigation Symposium (PLANS), 2016.
Farshteindiker, Benyamin, et al. "How to Phone Home with Someone Else's Phone: Information Exfiltration Using
Intentional Sound Noise on Gyroscopic Sensors." WOOT. 2016.

Acknowledgement
Dr. Sun, Yinan - Tsinghua University
Dr. Li, Ke

Q&AThank you.