More Web Proxy on the site http://driver.im/

Article

Rocking drones with intentional sound noise on gyroscopic sensors

Authors:

Youngseok Park,

Yongdae KimAuthors Info & Claims

SEC'15: Proceedings of the 24th USENIX Conference on Security Symposium

Pages 881 - 896

Published: 12 August 2015 Publication History

Abstract

Sensing and actuation systems contain sensors to observe the environment and actuators to influence it. However, these sensors can be tricked by maliciously fabricated physical properties. In this paper, we investigated whether an adversary could incapacitate drones equipped with Micro-Electro-Mechanical Systems (MEMS) gyroscopes using intentional sound noise. While MEMS gyroscopes are known to have resonant frequencies that degrade their accuracy, it is not known whether this property can be exploited maliciously to disrupt the operation of drones.

We first tested 15 kinds of MEMS gyroscopes against sound noise and discovered the resonant frequencies of seven MEMS gyroscopes by scanning the frequencies under 30 kHz using a consumer-grade speaker. The standard deviation of the resonant output from those gyroscopes was dozens of times larger than that of the normal output. After analyzing a target drone's flight control system, we performed real-world experiments and a software simulation to verify the effect of the crafted gyroscope output. Our real-world experiments showed that in all 20 trials, one of two target drones equipped with vulnerable gyroscopes lost control and crashed shortly after we started our attack. A few interesting applications and countermeasures are discussed at the conclusion of this paper.

References

[1]

A Critical Review of MEMS Gyroscopes Technology and Commercialization Status. http://invensense.com/mems/gyro/ documents/whitepapers/MEMSGyroComp.pdf.

[2]

Alibaba begins drone delivery trials in China. http://www. bbc.com/news/technology-31129804.

[3]

Amazon Prime Air (Amazon.com, Inc.). http://www.amazon. com/b?node=8037720011.

[4]

Analog Devices ADXRS610 datasheet. http://www. analog.com/media/en/technical-documentation/ data-sheets/ADXRS610.pdf.

[5]

AR.Drone (Parrot, Inc). http://ardrone2.parrot.com/.

[6]

Arduino UNO. http://arduino.cc/.

[7]

ArduPilot (open-source drone project). https://github.com/ diydrones/ardupilot.

[8]

Brüel & Kjær Microphone Unit Type 4189-A-021. http://www.bksv.com/Products/transducers/ acoustic/microphones/microphone-cartridges/4189.

[9]

Design and Analysis of MEMS Gyroscopes (Tutorial at IEEE Sensor 2013). http://ieee-sensors2013.org/ sites/ieee-sensors2013.org/files/Serrano_Slides_ Gyros2.pdf.

[10]

Everything about STMicroelectronics' 3-axis digital MEMS gyroscopes. http://www.st.com/web/en/resource/ technical/document/technical_article/DM00034730. pdf.

[11]

German pirate party uses drone to crash angela merkel event. http://www.slate.com/blogs/future_tense/2013/ 09/18/german_pirate_party_uses_drone_to_crash_ event_with_chancellor_angela_merkel.html.

[12]

Hi-Vi B1S Full Range Loudspeaker. https://www. madisoundspeakerstore.com/approx-1-fullrange/ hi-vi-b1s-full-range/.

[13]

InvenSense IMU3000 datasheet. http://www.invensense. com/mems/gyro/documents/PS-IMU-3000A.pdf.

[14]

InvenSense ITG3200 datasheet. http://www.invensense. com/mems/gyro/documents/EB-ITG-3200-00-01.1.pdf.

[15]

InvenSense IXZ650 datasheet. http://invensense.com/ mems/gyro/documents/PS-IXZ-0650B-00-01.pdf.

[16]

InvenSense MPU3050 datasheet. http://www.invensense. com/mems/gyro/documents/PS-MPU-3000A.pdf.

[17]

InvenSense MPU6000/6050 datasheet. http: //www.invensense.com/mems/gyro/documents/ PS-MPU-6000A-00v3.4.pdf.

[18]

InvenSense MPU6500 datasheet. http://www.invensense. com/mems/gyro/documents/PS-MPU-6500A-01.pdf.

[19]

InvenSense MPU9150 datasheet. http://dlnmh9ip6v2uc. cloudfront.net/datasheets/Sensors/IMU/ PS-MPU-9150A.pdf.

[20]

iPhone 5s Teardown. https://www.ifixit.com/Teardown/ iPhone+5s+Teardown/17383.

[21]

LRAD 450XL datasheet. http://www.lradx.com/ wp-content/uploads/2015/05/LRAD_Datasheet_450XL. pdf.

[22]

Market share information of MEMS gyroscope in 2013 (page 17). http://www.semiconwest.org/sites/ semiconwest.org/files/data14/docs/SW2014_JCEloy_ YoleDeveloppement_0.pdf.

[23]

Meyersound SB-3F datasheet. http://www.meyersound. com/sites/default/files/sb-3f_ppi.pdf.

[24]

Multiwii (open-source drone project). https://github.com/ multiwii/baseflight and https://code.google.com/p/ multiwii/.

[25]

Murata ENC-03MB datasheet. http://www.mouser.com/ catalog/specsheets/ENC-03M_ref.pdf.

[26]

National Instruments USB-4431, Sound and Vibration Data Acquisition Instrument. http://www.ni.com/pdf/products/ us/cat_usb4431.pdf.

[27]

Relative Sound Pressure according to Amplitude. http://www. indiana.edu/~emusic/acoustics/amplitude.htm.

[28]

STMicroelectronics L3G4200D datasheet. http: //www.st.com/web/en/resource/technical/document/ datasheet/CD00265057.pdf.

[29]

STMicroelectronics L3GD20 datasheet. http://www.st.com/ st-web-ui/static/active/en/resource/technical/ document/datasheet/DM00036465.pdf.

[30]

STMicroelectronics LPR5150AL datasheet. http: //www.st.com/web/en/resource/technical/document/ datasheet/CD00237211.pdf.

[31]

STMicroelectronics LPY503AL datasheet. http: //www.st.com/web/en/resource/technical/document/ datasheet/CD00237199.pdf.

[32]

STMicroelectronics LSM330 datasheet. http://www.st.com/ web/en/resource/technical/document/datasheet/ DM00059856.pdf.

[33]

UltraElectronics HyperShield datasheet. http: //www.ultra-hyperspike.com/Data/Pages/ 26fa8e2abe074313d60fe15a9af35440-HyperShield_ Dat_Sheet.pdf.

[34]

White house drone crash described as a u.s. workers drunken lark. http://www.nytimes.com/2015/01/28/us/ white-house-drone.html.

[35]

ADAMS, S., BERTSCH, F., SHAW, K., HARTWELL, P., MACDONALD, N. C., AND MOON, F. Capacitance Based Tunable Micromechanical Resonators. In International Conference on Solid-State Sensors and Actuators (1995).

[36]

CAI, L., AND CHEN, H. On the practicality of motion based keystroke inference attack. In Trust and Trustworthy Computing. Springer Berlin Heidelberg, 2012.

Digital Library

[37]

CASTRO, S., DEAN, R., ROTH, G., FLOWERS, G. T., AND GRANTHAM, B. Influence of acoustic noise on the dynamic performance of MEMS gyroscopes. In International Mechanical Engineering Congress and Exposition (2007), American Society of Mechanical Engineers.

[38]

DEAN, R. N., CASTRO, S. T., FLOWERS, G. T., ROTH, G., AHMED, A., HODEL, A. S., GRANTHAM, B. E., BITTLE, D. A., AND BRUNSCH, J. P. A characterization of the performance of a MEMS gyroscope in acoustically harsh environments. IEEE Transactions on Industrial Electronics 58 (2011).

[39]

DEAN, R. N., FLOWERS, G. T., HODEL, A. S., ROTH, G., CASTRO, S., ZHOU, R., MOREIRA, A., AHMED, A., RIFKI, R., GRANTHAM, B. E., ET AL. On the degradation of MEMS gyroscope performance in the presence of high power acoustic noise. In IEEE International Symposium on Industrial Electronics (2007).

[40]

DUC, N. M., AND MINH, B. Q. Your face is not your password face authentication bypassing Lenovo-Asus-Toshiba. Black Hat Briefings (2009).

[41]

FOWLKES, J. B., AND HOLLAND, C. K. Section 4: Bioeffects in tissues with gas bodies. Journal of ultrasound in medicine 19 (2000).

[42]

GALBALLY, J., CAPPELLI, R., LUMINI, A., MALTONI, D., AND FIERREZ, J. Fake fingertip generation from a minutiae template. In International Conference on Pattern Recognition (2008).

[43]

JEONG, C., SEOK, S., LEE, B., KIM, H., AND CHUN, K. A study on resonant frequency and Q factor tunings for MEMS vibratory gyroscopes. Journal of Micromechanics and Microengineering 14 (2004).

[44]

KAMKAR, S. SkyJack. http://samy.pl/skyjack/, 2013.

[45]

KUNE, D. F., BACKES, J., CLARK, S. S., KRAMER, D., REYNOLDS, M., FU, K., KIM, Y., AND XU, W. Ghost talk: mitigating EMI signal injection attacks against analog sensors. In IEEE Symposium on Security and Privacy (2013).

Digital Library

[46]

MATSUMOTO, T., MATSUMOTO, H., YAMADA, K., AND HOSHINO, S. Impact of artificial gummy fingers on fingerprint systems. In Electronic Imaging (2002), International Society for Optics and Photonics.

[47]

MILUZZO, E., VARSHAVSKY, A., BALAKRISHNAN, S., AND CHOUDHURY, R. R. Tapprints: your finger taps have fingerprints. In Proceedings of the ACM international conference on Mobile Systems, Applications, and Services (2012).

Digital Library

[48]

OREN, Y., AND KEROMYTIS, A. D. From the aether to the ethernet-attacking the internet using broadcast digital television. In Proceedings of the USENIX Security Symposium (2014).

Digital Library

[49]

ROTH, G. Simulation of the Effects of Acoustic Noise on MEMS Gyroscopes. Master's thesis, Auburn University, 2009.

[50]

SAMLAND, F., FRUTH, J., HILDEBRANDT, M., HOPPE, T., AND DITTMANN, J. AR. Drone: security threat analysis and exemplary attack to track persons. In Society of Photo-Optical Instrumentation Engineers Conference Series (2012).

[51]

SHOUKRY, Y., MARTIN, P., TABUADA, P., AND SRIVASTAVA, M. Non-invasive spoofing attacks for anti-lock braking systems. In Cryptographic Hardware and Embedded Systems. Springer, 2013.

Digital Library

[52]

SOOBRAMANEY, P. Mitigation of the Effects of High Levels of High-Frequency Noise on MEMS Gyroscopes. PhD thesis, Auburn University, 2013.

[53]

TANDY, V., AND LAWRENCE, T. R. The ghost in the machine. Journal of the Society for Psychical Research 62 (1998).

[54]

WIKIPEDIA. Acoustic hailing device -- wikipedia, the free encyclopedia, 2015. [Online; accessed 17-June-2015].

[55]

WIKIPEDIA. Inertial measurement unit -- wikipedia, the free encyclopedia, 2015. [Online; accessed 17-June-2015].

[56]

WIKIPEDIA. Long range acoustic device -- wikipedia, the free encyclopedia, 2015. [Online; accessed 17-June-2015].

[57]

WIKIPEDIA. Sonic weapon -- wikipedia, the free encyclopedia, 2015. [Online; accessed 17-June-2015].

[58]

WIKIPEDIA. Sound pressure--wikipedia, the free encyclopedia, 2015. [Online; accessed 17-June-2015].

[59]

YAN MICHALEVSKY AND DAN BONEH AND GABI NAKIBLY. Gyrophone: Recognizing speech from gyroscope signals. In Proceedings of the USENIX Security Symposium (2014).

Digital Library

Cited By

Lu PZhang LLiu MSridhar KSokolsky OKong FLee I(2024)Recovery from Adversarial Attacks in Cyber-physical Systems: Shallow, Deep, and Exploratory WorksACM Computing Surveys10.1145/365397456:8(1-31)Online publication date: 26-Apr-2024
https://dl.acm.org/doi/10.1145/3653974
Minn WTun YShar LJiang LRoychoudhury APaiva AAbreu RStorey M(2024)DronLomaly: Runtime Log-based Anomaly Detector for DJI DronesProceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings10.1145/3639478.3640042(6-10)Online publication date: 14-Apr-2024
https://dl.acm.org/doi/10.1145/3639478.3640042
Park SKim YLee D(2023)SCVMON: Data-oriented attack recovery for RVs based on safety-critical variable monitoringProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3607199.3607221(547-563)Online publication date: 16-Oct-2023
https://dl.acm.org/doi/10.1145/3607199.3607221
Show More Cited By

Recommendations

Neutralizing Hostile Drones with Surveillance Drones
CODASPY '21: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy

In this paper we discuss a technique to safeguard specific airspace from intruding drones with the help of surveillance drones. The idea is to use multiple surveillance drones to patrol through the area looking for suspicious flying objects. The ...
Encapsulated micro mechanical sensors

Encapsulated micro mechanical sensors were fabricated using glass-silicon anodic bonding and an electrical feedthrough structure. Two parallel plates which can be used not only for capacitive sensors but also electrostatic actuators are adopted for ...
Drones: The Complete Collection Three books in one. Drones The Professional Drone Pilot's Manual, Drones Mastering Flight Techniques, Drones Fly Your Drone Anywhere Without Getting Busted

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image Guide Proceedings

SEC'15: Proceedings of the 24th USENIX Conference on Security Symposium

August 2015

1072 pages

ISBN:9781931971232

Editor:
Jaeyeon Jung
Microsoft Research

Sponsors

USENIX Assoc: USENIX Assoc

Publisher

USENIX Association

United States

Publication History

Published: 12 August 2015

Qualifiers

Article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

33
Total Citations
View Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 20 Dec 2024

Other Metrics

View Author Metrics

Citations

Cited By

Lu PZhang LLiu MSridhar KSokolsky OKong FLee I(2024)Recovery from Adversarial Attacks in Cyber-physical Systems: Shallow, Deep, and Exploratory WorksACM Computing Surveys10.1145/365397456:8(1-31)Online publication date: 26-Apr-2024
https://dl.acm.org/doi/10.1145/3653974
Minn WTun YShar LJiang LRoychoudhury APaiva AAbreu RStorey M(2024)DronLomaly: Runtime Log-based Anomaly Detector for DJI DronesProceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings10.1145/3639478.3640042(6-10)Online publication date: 14-Apr-2024
https://dl.acm.org/doi/10.1145/3639478.3640042
Park SKim YLee D(2023)SCVMON: Data-oriented attack recovery for RVs based on safety-critical variable monitoringProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3607199.3607221(547-563)Online publication date: 16-Oct-2023
https://dl.acm.org/doi/10.1145/3607199.3607221
Bolton CLong YHan JHester JFu K(2023)Characterizing and Mitigating Touchtone Eavesdropping in Smartphone Motion SensorsProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3607199.3607203(164-178)Online publication date: 16-Oct-2023
https://dl.acm.org/doi/10.1145/3607199.3607203
Sadhu VAnjum KPompili D(2023)On-Board Deep-Learning-Based Unmanned Aerial Vehicle Fault Cause Detection and Classification via FPGAsIEEE Transactions on Robotics10.1109/TRO.2023.326938039:4(3319-3331)Online publication date: 1-Aug-2023
https://dl.acm.org/doi/10.1109/TRO.2023.3269380
Rugo AArdagna CIoini N(2022)A Security Review in the UAVNet Era: Threats, Countermeasures, and Gap AnalysisACM Computing Surveys10.1145/348527255:1(1-35)Online publication date: 17-Jan-2022
https://dl.acm.org/doi/10.1145/3485272
Hu YKuang WQin ZLi KZhang JGao YLi WLi K(2021)Artificial Intelligence Security: Threats and CountermeasuresACM Computing Surveys10.1145/348789055:1(1-36)Online publication date: 23-Nov-2021
https://dl.acm.org/doi/10.1145/3487890
Guo XHan SHu XJiao XJin YKong FLemmon MPhan LBroman D(2021)Towards scalable, secure, and smart mission-critical IoT systemsProceedings of the 2021 International Conference on Embedded Software10.1145/3477244.3477624(1-10)Online publication date: 30-Sep-2021
https://dl.acm.org/doi/10.1145/3477244.3477624
Birnbach SBaker REberz SMartinovic I(2021)#PrettyFlyForAWiFiACM Transactions on Privacy and Security10.1145/347367224:4(1-34)Online publication date: 30-Sep-2021
https://dl.acm.org/doi/10.1145/3473672
Zambrano ABetancur ABurbano LNiño AGiraldo LSoto MGiraldo JCardenas AKim YKim JVigna GShi E(2021)You Make Me Tremble: A First Look at Attacks Against Structural Control SystemsProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security10.1145/3460120.3485386(1320-1337)Online publication date: 12-Nov-2021
https://dl.acm.org/doi/10.1145/3460120.3485386
Show More Cited By

View Options

View options

Media

Figures

Other

Tables

View Table of Contents