Abstract:Cyber-physical systems depend on sensors to make automated decisions. Resonant acoustic injection attacks are already known to cause malfunctions by disabling MEMS-based gyroscopes. However, an open question remains on how to move beyond denial of service attacks to achieve full adversarial control of sensor outputs. Our work investigates how analog acoustic injection attacks can damage the digital integrity of a popular type of sensor: the capacitive MEMS accelerometer. Spoofing such sensors with intentional acoustic interference enables an out-of-spec pathway for attackers to deliver chosen digital values to microprocessors and embedded systems that blindly trust the unvalidated integrity of sensor outputs. Our contributions include (1) modeling the physics of malicious acoustic interference on MEMS accelerometers, (2) discovering the circuit-level security flaws that cause the vulnerabilities by measuring acoustic injection attacks on MEMS accelerometers as well as systems that employ on these sensors, and (3) two software-only defenses that mitigate many of the risks to the integrity of MEMS accelerometer outputs. We characterize two classes of acoustic injection attacks with increasing levels of adversarial control: output biasing and output control. We test these attacks against 20 models of capacitive MEMS accelerometers from 5 different manufacturers. Our experiments find that 75% are vulnerable to output biasing, and 65% are vulnerable to output control. To illustrate end-to-end implications, we show how to inject fake steps into a Fitbit with a $5 speaker. In our self-stimulating attack, we play a malicious music file from a smartphone's speaker to control the on-board MEMS accelerometer trusted by a local app to pilot a toy RC car. In addition to offering hardware design suggestions to eliminate the root causes of insecure amplification and filtering, we introduce two low-cost software defenses that mitigate output biasing attacks: randomized sampling and 180° out-of-phase sampling. These software-only approaches mitigate attacks by exploiting the periodic and predictable nature of the malicious acoustic interference signal. Our results call into question the wisdom of allowing microprocessors and embedded systems to blindly trust that hardware abstractions alone will ensure the integrity of sensor outputs.

An Intentional Acoustic Interference Approach To Control Output Signals Of Mems Gyroscope Based On Short-Time Fourier Analysis

Identification and Suppression of Driving Force Misalignment Angle for a MEMS Gyroscope Using Parametric Excitation

Noise Analysis and Modeling for a Digital Control Architecture for Lissajous Frequency-Modulated MEMS Gyroscope with Amplitude-Modulated Readout

Design and Test of MEMS Gyroscope Control System Based on LMSD

A Sub-0.1°/H Bias-Instability MEMS Gyroscope Using Resonant Constant-Frequency Driving Technique

MEMS gyroscopes parametric excitation control scheme with constant resonant frequency

A 0.09°/h Bias-Instability MEMS Gyroscope Working with a Fixed Resonance Frequency

Drive Mode Control for MEMS Gyroscopes with Electrostatically Tunable Structure

One-time Frequency Sweep to Eliminate IQ Coupling in MEMS Vibratory Gyroscopes

An Improved Phase-Robust Configuration for Vibration Amplitude-Phase Extraction for Capacitive MEMS Gyroscopes

Performance Improvement for MEMS Gyroscopes by Suppressing the Circuit Phase Delay

WALNUT: Waging Doubt on the Integrity of MEMS Accelerometers with Acoustic Injection Attacks

A Robust Triangular-Electrode Based Capacitive Detection Method For Mems Gyroscopes

A Novel Amplitude-Phase Information Extraction Architecture for MEMS Vibratory Gyroscopes Using a Modified Double Side-Band Demodulation Configuration

Analysis on Digital Automatic Gain Control of MEMS Gyro Driven-Loop Circuit

A novel oscillation control for MEMS vibratory gyroscopes using a modified electromechanical amplitude modulation technique

An Interface ASIC for MEMS Vibratory Gyroscopes with Nonlinear Driving Control

Effective Bias Warm-Up Time Reduction for MEMS Gyroscopes Based on Active Suppression of the Coupling Stiffness

Digital closed-loop controller design of a micromachined gyroscope based on auto frequency swept

Harmonic Disturbance Observer-Based Sliding Mode Control of MEMS Gyroscopes

Neural-Network-Based Constrained Output-Feedback Control for MEMS Gyroscopes Considering Scarce Transmission Bandwidth