Abstract:Touchscreen-based electronic devices such as smart phones and smart tablets are widely used in our daily life. While the security of electronic devices have been heavily investigated recently, the resilience of touchscreens against various attacks has yet to be thoroughly investigated. In this paper, for the first time, we show that touchscreen-based electronic devices are vulnerable to intentional electromagnetic interference (IEMI) attacks in a systematic way and how to conduct this attack in a practical way. Our contribution lies in not just demonstrating the attack, but also analyzing and quantifying the underlying mechanism allowing the novel IEMI attack on touchscreens in detail. We show how to calculate both the minimum amount of electric field and signal frequency required to induce touchscreen ghost touches. We further analyze our IEMI attack on real touchscreens with different magnitudes, frequencies, duration, and multitouch patterns. The mechanism of controlling the touchscreen-enabled electronic devices with IEMI signals is also elaborated. We design and evaluate an out-of-sight touchscreen locator and touch injection feedback mechanism to assist a practical IEMI attack. Our attack works directly on the touchscreen circuit regardless of the touchscreen scanning mechanism or operating system. Our attack can inject short-tap, long-press, and omni-directional gestures on touchscreens from a distance larger than the average thickness of common tabletops. Compared with the state-of-the-art touchscreen attack, ours can accurately inject different types of touch events without the need for sensing signal synchronization, which makes our attack more robust and practical. In addition, rather than showing a simple proof-of-concept attack, we present and demonstrate the first ready-to-use IEMI based touchscreen attack vector with end-to-end attack scenarios.

BitDance: Manipulating UART Serial Communication with IEMI

In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

A Novel EMI Attack Exploiting the Control Vulnerability of Photovoltaic Inverters

Intentional Electromagnetic Interference Attack Against Infrared Thermal Imaging Sensor

EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras

WIGHT: Wired Ghost Touch Attack on Capacitive Touchscreens

Ghost-in-ZigBee: Energy Depletion Attack on ZigBee-Based Wireless Networks

Authenticating Smart Home Devices Via Home Limited Channels

GhostType: the Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards

Marionette: Manipulate Your Touchscreen Via A Charging Cable

Electromagnetic Signal Injection Attacks on Differential Signaling

Invisible Finger: Practical Electromagnetic Interference Attack on Touchscreen-based Electronic Devices

Physical-World Attack towards WiFi-based Behavior Recognition

A Reflection-Based Channel Fingerprint to Locate Physically Intrusive Devices in ICS

IREXF: Data Exfiltration from Air-gapped Networks by Infrared Remote Control Signals

Eavesdropping Vulnerability and Countermeasure in Infrared Communication for IoT Devices

Potential Risk of IoT Device Supporting IR Remote Control.

Ghost-in-the-Wireless: Energy Depletion Attack on ZigBee

Channel-State-Based Fingerprinting Against Physical Access Attack in Industrial Field Bus Network

PuppetMouse: Practical and Contactless Mouse Manipulation Attack Via Intentional Electromagnetic Interference Injection

A Signal Injection Attack Against Zero Involvement Pairing and Authentication for the Internet of Things