# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### New Attacks
#### 3.21.2 Covert Channel  
[PERSON] and [PERSON] [32] noticed that smart lights controlled remotely can be used to leak data from a highly secure building or even trigger seizures. Utilizing original APIs, they changed the lightness of LED bulbs without sharp changes, created a receiver to measure the exact duration and frequency of those flickers and then obtained the leaked information. After testing on different systems, including expensive systems (Philips HUE) to cheap systems (LimitlessLED), the authors found that this attack can be performed from over 100 m away and leak more than 10 KB per day.  
[PERSON] et al. [33] discussed a new attack that utilizes hidden voice commands, which are unintelligible to human listeners but are interpreted as commands by a voice assistant. The authors evaluated these attacks under a black-box model and white-box model. Whether an attacker has complete knowledge of the speech recognition system or not, they can attack the system through a hidden voice that contains malicious commands. They also proposed passive and active defense methods to mitigate these attacks, including a protocol for informing a user when a device accepts a voice command, a verbal challenge-response protocol, and a machine learning method that can detect these attacks with 99.8% accuracy.  
[PERSON] et al. [77] proposed a new method to use the analog emissions of physical instrumentation (e.g., actuators and sensors) to leak sensitive or process-specific information through side channels, such as power, electromagnetic, thermal, and acoustic channels. They also considered the controller's dynamics and its closed-loop characteristics to avoid triggering the CPS alarm system. They demonstrated the control-theoretic approach on a hardware-in-the-loop (HITL) testbed and emulated a chemical process plant's benchmark industrial control system. They successfully sent a message over the acoustic side channel with a motor and received it.  
[PERSON] et al. [97] tried to mitigate the information leakage problems in smart manufacturing systems. They optimized the design variables and machine process in the cyber-domain (e.g., slicing and tool-path generation algorithms) with the help of leakage-aware computer-aided manufacturing (CAM) tools. In a real-world manufacturing system, this methodology reduces mutual information by almost 30% in acoustic, power, and magnetic side channels and by more than half in vibration side channels.  
[PERSON] and [PERSON] [78] described a new scenario in which a sensor can coordinate with an actuator to launch an attack and built a provably secure covert channel from a chatty sensor to a corrupt actuator via only a threshold-logic control loop. The sensor leaks messages that are encoded with the time of the transition by adding small values of the reported measurements to the controller. Through the simulation developed by [PERSON] [164] for a wastewater treatment process, the results showed that, even by anomaly-detection systems, corrupt covert sensors and covert actuators cannot be detected.  
[PERSON] et al. [34] proposed a novel approach that uses low-cost motion sensors to detect hidden voice commands against voice assistants. The authors leveraged audio and vibrant features to generate unique signatures, which can be easily deployed on smartphones with onboard motion sensors. Then, they used machine learning approaches to identify the statistical acoustic features and distinguish hidden voice commands from normal commands. The experimental results showed that the accuracy reaches 99.9% with low-cost motion sensors.