![Page 1: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/1.jpg)
SONIC GUN TO SMART DEVICES YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND
![Page 2: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/2.jpg)
Authors
Wang, Zhengbo & Wang, Kang Alibaba Security
Yang, BoCAICT
Li, Shangyuan Tsinghua University
Pan, AiminAlibaba Security
![Page 3: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/3.jpg)
About Us
- Who are we:A research team of Alibaba security.
- Our research interests: Security issues about IoT, AI and their combinations.
- Previous briefing:Time and Position Spoofing with Open Source Projects
Blackhat Europe 2015
![Page 4: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/4.jpg)
Outline
- An attack demo of Oculus headset - Physical Principle of MEMS - Other attack attempts on VR devices - Attack attempts on drones - Attack attempts on self-balanced vehicles - - Countermeasures
![Page 6: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/6.jpg)
How This Happens?
Photo from ifixit.com
![Page 7: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/7.jpg)
What is MEMSMicro Electro-Mechanical Systems
![Page 8: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/8.jpg)
What is MEMS
![Page 9: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/9.jpg)
How MEMS WorksAccelerometer
![Page 10: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/10.jpg)
How MEMS Works
Sensing Mass
Springs
Capacitor
Accelerometer
![Page 11: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/11.jpg)
m
CC
How MEMS Works
CC
Accelerometer
1 DoF (Degree of Freedom) Spring-Mass System
![Page 12: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/12.jpg)
How MEMS Works
C↑C↓
C↑C↓
Accelerometer
![Page 13: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/13.jpg)
How MEMS Works
C↑ C↓
C↑ C↓
Accelerometer
![Page 14: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/14.jpg)
How MEMS Works
C↑C↓
C↑C↓
Accelerometer
![Page 15: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/15.jpg)
How MEMS Works
C↑ C↓
C↑ C↓
Accelerometer
![Page 16: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/16.jpg)
m
How MEMS WorksAccelerometer
acc acc
![Page 17: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/17.jpg)
How to Attack
m
Resonance
![Page 18: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/18.jpg)
Previous Work
T. Trippel, et al. EuroS&P, 2017.
![Page 19: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/19.jpg)
How MEMS WorksGyroscope
![Page 20: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/20.jpg)
How MEMS WorksGyroscope
![Page 21: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/21.jpg)
m m
m
No Rotation
cosω0t
How MEMS WorksGyroscope
2 DoF (Degree of Freedom) Spring-Mass System
![Page 22: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/22.jpg)
m m
m
Rotation
cosω0t
D:displacement D = A cos ω0t A > 0 : clockwise rotation A < 0 : counter clockwise
How MEMS WorksGyroscope
![Page 23: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/23.jpg)
Fc = 2mv×W
Fc - Coriolis forcem - vibratory massv - linear velocityW - angular rotation
W
How MEMS WorksGyroscope
![Page 24: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/24.jpg)
Fc = 2mv×W
Fc - Coriolis forcem - vibratory massv - linear velocityW - angular rotation
How MEMS WorksGyroscope
![Page 25: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/25.jpg)
How MEMS Works
m m
m
Rotation
cosω0t
D:displacement
Nornal Output:
OUT = LPF{2 D cos ω0t} = LPF{2 A cos ω0t cos ω0t} = LPF{A + A cos 2ω0t} = A
![Page 26: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/26.jpg)
How to Attack
Attack Output:
OUT = LPF{2 D cos ω0t}
= LPF{Au cos [(ω0-ωu)t - ΔΦ] + Au cos [(ω0+ωu)t + ΔΦ]}
= Au cos [(ω0-ωu)t - ΔΦ]
Displacement Under Attack:
D = Au cos(ωut + ΔΦ)
Au : ultrasound induced amplitude
ωu : ultrasound frequency
ΔΦ : ultrasound phase shift
Gyroscope
![Page 27: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/27.jpg)
0 < < πOUT > 0
pi < < 2πOUT < 0
How to AttackGyroscope
![Page 28: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/28.jpg)
How to AttackGyroscope
: 0 π
![Page 29: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/29.jpg)
Modulation Demo
11
00
10
01
1 1 0 0 0 1 0 1 ...
B. Farshteindiker, WOOT, 2016
This work.
![Page 30: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/30.jpg)
Attack Attempts
VR Devices(including Phones) Facebook Oculus Rift CV1
HTC Vive + ControllerMicrosoft HoloLensiPhone 7Samsung Galaxy S7
DroneDJI phantom 3
Self Balancing Vehicles(including Toys)DIY balancing robot Mi Mitu toy robotMi Ninebot Mini
![Page 34: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/34.jpg)
Video Demo: Samsung S7
STMicroelectronics LSM6DS3
MEMS Chip
![Page 40: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/40.jpg)
DIY Self-balancing RobotMPU6050 module
Acknowledgement: Resonating frequency first found by T. Trippel, et al. EuroS&P, 2017.
![Page 43: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/43.jpg)
Commerical Scooter
Without Power Amplifier With Power Amplifier
![Page 44: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/44.jpg)
What about real car?
?
![Page 45: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/45.jpg)
MEMS and Security: An inexhaustive list
Gyroscope Accelerometer Other MEMS*
DoS Son, et al. Trippel, et al. TODO
Manipulation This work! Trippel, et al. TODO
Long Range TODO TODO TODO
* Other MEMS chips include MEMS microphones, barometers, digital micromirror display and so on.
![Page 46: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/46.jpg)
Countermeasures1. Shell
- prevent sonic energy from intruding.- reflective material with multilayer may be considered.
2. Software- actively detect the resonating sound with microphone.
- warn or perform noise cancelling.
3. Chip- new design of MEMS chips that can resist sonic attacks*.
4. Multi Sensors*Serrano D E, et al. PLANS, 2016.
![Page 47: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/47.jpg)
BOM
Device Model Price
Signal Genenerator SP F20AMax Freq: 20MHz (>> 30kHz)Max Ampl: 20Vpp
$320
Ultrasound Emitter 2425 $0.4
Amplifier TDA8932 $2
DC Power LRS-100-24 $10
Signal Generator(Cheaper one)
UTG9002CMax Freq: 2MHzMax Ampl: 25Vpp
$16
![Page 48: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/48.jpg)
References1. Man, Kin F. "MEMS reliability for space applications by elimination of potential failure modes through testing and
analysis." MEMS Reliability for Critical and Space Applications. Vol. 3880. 1999.2. Dean, Robert N., et al. "On the degradation of MEMS gyroscope performance in the presence of high power acoustic
noise." Industrial Electronics, 2007. ISIE 2007. IEEE International Symposium on. IEEE, 2007.3. Castro, Simon, et al. "Influence of acoustic noise on the dynamic performance of MEMS gyroscopes." ASME 2007
International Mechanical Engineering Congress and Exposition. American Society of Mechanical Engineers, 2007.4. Son, Yunmok, et al. "Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors." USENIX Security. 2015.5. Trippel, Timothy, et al. "WALNUT: Waging doubt on the integrity of mems accelerometers with acoustic injection
attacks." IEEE European Symposium on Security and Privacy, 2017.6. Mikko Saukoski. System and circuit design for a capacitive mems gyroscope, Doctoral Dissertation, 2008.7. Serrano D E, et al. Environmentally-robust high-performance tri-axial bulk acoustic wave gyroscopes. Position,
Location and Navigation Symposium (PLANS), 2016.8. Farshteindiker, Benyamin, et al. "How to Phone Home with Someone Else's Phone: Information Exfiltration Using
Intentional Sound Noise on Gyroscopic Sensors." WOOT. 2016.
AcknowledgementDr. Sun, Yinan - Tsinghua UniversityDr. Li, Ke
![Page 49: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/49.jpg)
Q&A
![Page 50: SONIC GUN TO SMART DEVICES - Black Hat | Home · sonic gun to smart devices your devices lose control under ultrasound/sound](https://reader031.vdocuments.site/reader031/viewer/2022020302/5ac1072c7f8b9a357e8c3254/html5/thumbnails/50.jpg)
Thank you.