skip to main content
10.1145/3560905.3568532acmconferencesArticle/Chapter ViewAbstractPublication PagessensysConference Proceedingsconference-collections
research-article

KITE: Exploring the Practical Threat from Acoustic Transduction Attacks on Inertial Sensors

Published: 24 January 2023 Publication History

Abstract

In cyber-physical systems, inertial sensors are the basis for identifying motion states and making actuation decisions. However, extensive studies have proved the vulnerability of those sensors under acoustic transduction attacks, which leverage malicious acoustics to trigger sensor measurement errors. Unfortunately, the threat from such attacks is not assessed properly because of the incomplete investigation on the attack's potential, especially towards multiple-degree-of-freedom systems, e.g., drones. To thoroughly explore the threat of acoustic transduction attacks, we revisit the attack model and design a new yet practical acoustic modulation-based attack, named KITE. Such an attack enables stable and controllable injections, even under frequency offset based distortions that limit the effect of prior attacking approaches. KITE exploits the potential threat of transduction attacks without the need of strengthening attackers' abilities. Furthermore, we extend the attack surface to multiple-degree-of-freedom systems, which are more widely deployed but ignored by prior work. Our study also covers the scenario of attacking moving targets. By revealing the practical threat from acoustic transduction attacks, we appeal for both the attention to their harm and necessary countermeasures.

References

[1]
Analog Devices, Inc. 2017. The five motion senses: Using MEMS inertial sensing to transform applications. https://www.analog.com.
[2]
S. A. Anand and N. Saxena. 2018. Speechless: Analyzing the Threat to Speech Privacy from Smartphone Motion Sensors. In IEEE Symposium on Security and Privacy.
[3]
Anonymous User. 2022. KITE. https://github.com/KITE-anonymous-user/KITE.git.
[4]
Z. Ba, T. Zheng, X. Zhang, Z. Qin, B. Li, X. Liu, and K. Ren. 2020. Learning-based Practical Smartphone Eavesdropping with Built-in Accelerometer. In Network and Distributed System Security Symposium.
[5]
J. J. Bernstein, S. Cho, A. T. King, A. Kourepenis, and M. Weinberg. 1993. A micromachined comb-drive tuning fork rate gyroscope. In IEEE Micro Electro Mechanical Systems.
[6]
K. Block, S. Narain, and G. Noubir. 2017. An Autonomic and Permissionless Android Covert Channel. In ACM Conference on Security and Privacy in Wireless and Mobile Networks.
[7]
Bosch, Inc. 2018. BMI160 Datasheet. https://www.bosch-sensortec.com/products/motion-sensors/imus/bmi160.html.
[8]
Bosch, Inc. 2020. BMI055 Datasheet. https://www.mouser.cn/datasheet/2/783/BST_BMI055_DS000-1509583.pdf.
[9]
B. Brannon and A. Barlow. 2006. Aperture Uncertainty and ADC System Performance. https://www.analog.com/media/en/technical-documentation_application-notes/an-501.pdf.
[10]
Burr-Brown Products from Texas Instruments. 2002. DAC902 Datasheet. https://www.ti.com/lit/ds/symlink/dac902.pdf.
[11]
L. Cai and H. Chen. 2011. TouchLogger: Inferring Keystrokes on Touch Screen from Smartphone Motion. In USENIX Workshop on Hot Topics in Security.
[12]
Y. Cao, C. Xiao, B. Cyr, Y. Zhou, W. Park, S. Rampazzi, Q. A. Chen, K. Fu, and Z. M. Mao. 2019. Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving. In ACM Conference on Computer and Communications Security.
[13]
W. Chen, L. Chen, Y. Huang, X. Zhang, l. Wang, R. Ruby, and K. Wu. 2019. Taprint: Secure Text Input for Commodity Smart Wristbands. In Annual International Conference on Mobile Computing and Networking.
[14]
H. Choi, W. Lee, Y. Aafer, F. Fei, Z. Tu, X. Zhang, D. Xu, and X. Xinyan. 2018. Detecting Attacks Against Robotic Vehicles: A Control Invariant Approach. In ACM Conference on Computer and Communications Security.
[15]
A. Das, N. Borisov, and M. Caesar. 2016. Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses. In Network and Distributed System Security Symposium.
[16]
D. Davidson, H. Wu, R. Jellinek, V. Singh, and T. Ristenpart. 2016. Controlling UAVs with Sensor Input Spoofing Attacks. In USENIX Workshop on Offensive Technologies.
[17]
R. Dean, N. Burch, M. Black, A. Beal, and G. Flowers. 2011. Microfibrous metallic cloth for acoustic isolation of a MEMS gyroscope. International Society for Optical Engineering 7979 (2011), 797909.
[18]
R. N. Dean, S. T. Castro, G. T. Flowers, G. Roth, A. Ahmed, A. S. Hodel, B. E. Grantham, D. A. Bittle, and J. P. Brunsch. 2011. A Characterization of the Performance of a MEMS Gyroscope in Acoustically Harsh Environments. IEEE Transaction on Industrial Electronics 58, 7 (2011), 2591--2596.
[19]
R. N. Dean, G. T. Flowers, A. S. Hodel, G. Roth, S. T. Castro, R. Zhou, A. Moreira, A. Ahmed, R. Rifki, B. E. Grantham, D. Bittle, and J. Brunsch. 2007. On the Degradation of MEMS Gyroscope Performance in the Presence of High Power Acoustic Noise. In IEEE International Symposium on Industrial Electronics.
[20]
S. Dey, N. Roy, W. Xu, R. R. Choudhury, and S. Nelakuditi. 2014. AccelPrint: Imperfections of Accelerometers Make Smartphones Trackable. In Network and Distributed System Security Symposium.
[21]
J. L. Esteves, E. Cottais, and C. Kasmi. 2018. Unlocking the access to the effects induced by IEMI on a civilian UAV. In International Symposium on Electromagnetic Compatibility.
[22]
M. Euston, P. Coote, R. Mahony, J. Kim, and T. Hamel. 2008. A complementary filter for attitude estimation of a fixed-wing UAV. In IEEE/RSJ International Conference on Intelligent Robots and Systems.
[23]
B. Farshteindiker, N. Hasidim, A. Grosz, and Y. Oren. 2016. How to Phone Home with Someone Else's Phone: Information Exfiltration Using Intentional Sound Noise on Gyroscopic Sensors. In USENIX Workshop on Offensive Technologies.
[24]
T. F.Hueter and R.H.Bolt. 1955. Sonics. John Wiley & Sons.
[25]
M. Gao, F. Lin, W. Xu, M. Nuermaimaiti, J. Han, W. Xu, and K. Ren. 2020. Deaf-Aid: Mobile IoT Communication Exploiting Stealthy Speaker-to-Gyroscope Channel. In Annual International Conference on Mobile Computing and Networking.
[26]
GRAS Acoustics, Inc. 2000. GRAS 46AM 1/2" CCP Free-field Standard Microphone Set, Wide Frequency. https://www.grasacoustics.com/products/measurement-microphone-sets/constant-current-power-ccp/product/551-46am.
[27]
J. Han, A. J. Chung, and P. Tague. 2017. PitchIn: Eavesdropping via Intelligible Speech Reconstruction Using Non-acoustic Sensor Fusion. In ACM/IEEE International Conference on Information Processing in Sensor Networks.
[28]
Harman Inc. 2019. JBL STADIUM GTO750T. https://www.onlinecarstereo.com/CarAudio/p_51143_JBL_STADIUMGTO750T.aspx.
[29]
J. Hou, X. Li, P. Zhu, Z. Wang, Y. Wang, J. Qian, and P. Yang. 2019. SignSpeaker: A Real-time, High-Precision SmartWatch-based Sign Language Translator. In Annual International Conference on Mobile Computing and Networking.
[30]
X. Ji, Y. Cheng, Y. Zhang, K. Wang, C. Yan, W. Xu, and K. Fu. 2021. Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision. In IEEE Symposium on Security and Privacy.
[31]
V. Kaajakari. 2009. Practical MEMS: Design of Microsystems, Accelerometers, Gyroscopes, RF MEMS, Optical MEMS, and Microfluidic Systems. Small Gear Publishing.
[32]
A. J. Kerns, D. P. Shepard, J. A. Bhatti, and T. E. Humphreys. 2014. Unmanned Aircraft Capture and Control Via GPS Spoofing. Journal of Field Robotics 31, 4 (2014), 617--636.
[33]
S. K. Khaitan and J. D. McCalley. 2015. Design Techniques and Applications of Cyberphysical Systems: A Survey. IEEE Systems Journal 9, 2 (2015), 350--365.
[34]
S. Khazaaleh, G. Korres, M. A. Eid, M. Rasras, and M. F. Daqaq. 2019. Vulnerability of MEMS Gyroscopes to Targeted Acoustic Attacks. IEEE Access 7 (2019), 89534--89543.
[35]
M. Kraft and N. M. White. 2013. MEMS for automotive and aerospace applications. MEMS for automotive tire pressure monitoring systems (2013), 54--77.
[36]
D. F. Kune, J. Backes, S. S. Clark, D. Kramer, M. Reynolds, K. Fu, Y. Kim, and W. Xu. 2013. Ghost talk: Mitigating EMI signal injection attacks against analog sensors. In IEEE Symposium on Security and Privacy.
[37]
A. G. Kuznetsov, Z. S. Abutidze, B. I. Portnov, V. I. Galkin, and A. A. Kalik. 2011. Development of MEMS sensors for aircraft control systems. Gyroscopy and Navigation 2, 1 (2011), 59--62.
[38]
F. Li, C. Zhao, G. Ding, J. Gong, C. Liu, and F. Zhao. 2012. A Reliable and Accurate Indoor Localization Method Using Phone Inertial Sensors. In ACM Conference on Ubiquitous Computing.
[39]
J. Liu, C. Wang, Y. Chen, and N. Saxena. 2017. VibWrite: Towards Finger-input Authentication on Ubiquitous Surfaces via Physical Vibration. In ACM Conference on Computer and Communications Security.
[40]
X. Liu, Z. Zhou, W. Diao, Z. Li, and K. Zhang. 2015. When Good Becomes Evil: Keystroke Inference with Smartwatch. In ACM Conference on Computer and Communications Security.
[41]
N. C. Macdonald, K. A. Shaw, and S. G. Adams. 2001. Microelectromechanical accelerometer for automotive applications. Smart Materials Bulletin 2001, 5 (2001), 16.
[42]
P. Marquardt, A. Verma, H. Carter, and P. Traynor. 2011. (sp)iPhone: decoding vibrations from nearby keyboards using mobile phone accelerometers. In ACM Conference on Computer and Communications Security.
[43]
MI, Inc. 2016. Mi Robot Builder. https://www.mi.com/global/mi-robot-builder.
[44]
Y. Michalevsky, D. Boneh, and G. Nakibly. 2014. Gyrophone: Recognizing Speech from Gyroscope Signals. In USENIX Security Symposium.
[45]
E. Miluzzo, A. Varshavsky, S. Balakrishnan, and R. R. Choudhury. 2012. Tapprints: your finger taps have fingerprints. In International Conference on Mobile Systems, Applications, and Services.
[46]
S. Narain, T. D. Vo-Huu, K. Block, and G. Noubir. 2016. Inferring User Routes and Locations Using Zero-Permission Mobile Sensors. In IEEE Symposium on Security and Privacy.
[47]
National Instruments, Inc. 2017. NI VituralBench 8012. https://www.ni.com/pdf/manuals/371527e.pdf.
[48]
J. Noh, Y. Kwon, Y. Son, H. Shin, D. Kim, J. Choi, and Y. Kim. 2019. Tractor Beam: Safe-hijacking of Consumer Drones with Adaptive GPS Spoofing. ACM Transactions on Privacy and Security 22, 2 (2019), 12:1--12:26.
[49]
Y. Park, Y. Son, H. Shin, D. Kim, and Y. Kim. 2016. This Ain't Your Dose: Sensor Spoofing Attack on Medical Infusion Pump. In USENIX Workshop on Offensive Technologies.
[50]
P. PX4. 2021. Open Source Autopilot for Drones - PX4 Autopilot. https://px4.io.
[51]
O. Pöllny, A. Held, and F. Kargl. 2021. The Effect Of Sound On The Gyroscopes In Your Car. In IEEE Vehicular Technology Conference.
[52]
R. Quinonez, J. Giraldo, L. E. Salazar, E. Bauman, A. A. Cárdenas, and Z. Lin. 2020. SAVIOR: Securing Autonomous Vehicles with Robust Physical Invariants. In USENIX Security Symposium.
[53]
A. Rai, K. K. Chintalapudi, V. N. Padmanabhan, and R. Sen. 2012. Zee: Zero-Effort Crowdsourcing for Indoor Localization. In Annual International Conference on Mobile Computing and Networking.
[54]
Raspberry Pi. 2021. Raspberry Pi Zero W. https://www.raspberrypi.org/pi-zero-w/.
[55]
N. Roy, M. Gowda, and R. R. Choudhury. 2015. Ripple: Communicating through Physical Vibration. In USENIX Symposium on Networked Systems Design and Implementation.
[56]
N. Roy, H. Hassanieh, and R. Roy Choudhury. 2017. BackDoor: Making Microphones Hear Inaudible Sounds. In ACM SIGMOBILE International Conference on Mobile Systems, Applications, and Services.
[57]
F. Sabath. 2011. What can be learned from documented Intentional Electromagnetic Interference (IEMI) attacks?. In URSI General Assembly and Scientific Symposium.
[58]
J. Selvaraj, G. Y. Dayanıklı, N. P. Gaunkar, D. Ware, R. M. Gerdes, and M. Mina. 2018. Electromagnetic Induction Attacks Against Embedded Systems. In ACM on Asia Conference on Computer and Communications Security.
[59]
J. Shen, J. Y. Won, Z. Chen, and Q. A. Chen. 2020. Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing. In USENIX Security Symposium.
[60]
H. Shin, D. Kim, Y. Kwon, and Y. Kim. 2017. Illusion and dazzle: Adversarial optical channel exploits against lidars for automotive applications. In International Conference on Cryptographic Hardware and Embedded Systems. 445--467.
[61]
Y. Shoukry, P. Martin, Y. Yona, S. Diggavi, and M. Srivastava. 2015. PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks. In ACM Conference on Computer and Communications Security.
[62]
Y. Son, J. Noh, J. Choi, and Y. Kim. 2018. GyrosFinger: Fingerprinting Drones for Location Tracking Based on the Outputs of MEMS Gyroscopes. ACM Transactions on Privacy and Security 21, 2 (2018), 10:1--10:25.
[63]
Y. Son, H. Shin, D. Kim, Y. Park, J. Noh, K. Choi, J. Choi, and Y. Kim. 2015. Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors. In USENIX Security Symposium.
[64]
P. Soobramaney, G. Flowers, and R. Dean. 2015. Mitigation of the Effects of High Levels of High-Frequency Noise on MEMS Gyroscopes Using Microfibrous Cloth. In Asme International Design Engineering Technical Conferences and Computers and Information in Engineering Conference.
[65]
STMicroelectronics. 2018. STM32-F407VET6 Datasheet. https://www.mouser.cn/datasheet/2/389/cd00191185-1796739.pdf.
[66]
J. Sun, Y. Cao, Q. A. Chen, and Z. M. Mao. 2020. Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures. In USENIX Security Symposium.
[67]
Y. Sun, P. Guo, L. Feng, C. Xing, and J. Wu. 2020. A Filtering Algorithm of MEMS Gyroscope to Resist Acoustic Interference. Sensors 20, 24 (2020), 7352.
[68]
W. T. Thomson. 1981. Theory of vibration with applications. Prentice Hall.
[69]
N. O. Tippenhauer, C. Pöpper, K. B. Rasmussen, and S. Capkun. 2011. On the requirements for successful GPS spoofing attacks. In ACM Conference on Computer and Communications Security.
[70]
T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu. 2017. WALNUT: Waging Doubt on the Integrity of MEMS Accelerometers with Acoustic Injection Attacks. In IEEE European Symposium on Security and Privacy.
[71]
Y. Tu, Z. Lin, I. Lee, and X. Hei. 2018. Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors. In USENIX Security Symposium.
[72]
Y. Tu, S. Rampazzi, B. Hao, A. Rodriguez, K. Fu, and X. Hei. 2019. Trick or Heat? Manipulating Critical Temperature-Based Control Systems Using Rectification Attacks. In ACM Conference on Computer and Communications Security.
[73]
C. Wang, X. Guo, Y. Wang, Y. Chen, and B. Liu. 2016. Friend or Foe?: Your Wearable Devices Reveal Your Personal PIN. In ACM on Asia Conference on Computer and Communications Security.
[74]
H. Wang, T. T. Lai, and R. R. Choudhury. 2015. MoLe: Motion Leaks through Smartwatch Sensors. In Annual International Conference on Mobile Computing and Networking.
[75]
Z. Wang, K. Wang, B. Yang, S. Li, and A. Pan. 2017. Sonic Gun to Smart Devices: Your Devices Lose Control Under Ultrasound/Sound. In Blackhat USA.
[76]
Z. Wang, W. Zhu, J. Miao, H. Zhu, C. Chao, and O. K. Tan. 2005. Micromachined thick film piezoelectric ultrasonic transducer array. Sensors & Actuators A Physical 130--131 (2005), 485--490.
[77]
H. Wen, J. Ramos Rojas, and A. K. Dey. 2016. Serendipity: Finger Gesture Recognition Using an Off-the-Shelf Smartwatch. In Conference on Human Factors in Computing Systems.
[78]
Wikipedia. 2021. Acoustic wave. https://en.wikipedia.org/wiki/Acoustic-wave.
[79]
C. Wu, K. He, J. Chen, Z. Zhao, and R. Du. 2020. Liveness is Not Enough: Enhancing Fingerprint Authentication with Behavioral Biometrics to Defeat Puppet Attacks. In USENIX Security Symposium.
[80]
W. Xu, C. Yan, W. Jia, X. Ji, and J. Liu. 2018. Analyzing and Enhancing the Security of Ultrasonic Sensors for Autonomous Vehicles. IEEE Internet Things Journal 5, 6 (2018), 5015--5029.
[81]
X. Xu, J. Yu, Y. chen, Q. Hua, Y. Zhu, Y.-C. Chen, and M. Li. 2020. TouchPass: Towards Behavior-Irrelevant on-Touch User Authentication on Smartphones Leveraging Vibrations. In Annual International Conference on Mobile Computing and Networking.
[82]
Z. Xu, K. Bai, and S. Zhu. 2012. TapLogger: inferring user inputs on smartphone touchscreens using on-board motion sensors. In ACM Conference on Security and Privacy in Wireless and Mobile Networks.
[83]
Y. Xue, J. Chen, W. Wan, Y. Huang, C. Yu, T. Li, and J. Bao. 2019. MVSCRF: Learning Multi-View Stereo With Conditional Random Fields. In IEEE/CVF International Conference on Computer Vision.
[84]
C. Yan, H. Shin, C. Bolton, W. Xu, Y. Kim, and K. Fu. 2020. SoK: A Minimalist Approach to Formalizing Analog Sensor Security. In IEEE Symposium on Security and Privacy.
[85]
Q. Yan, K. Liu, Q. Zhou, H. Guo, and N. Zhang. 2020. SurfingAttack: Interactive Hidden Attack on Voice Assistants Using Ultrasonic Guided Waves. In Network and Distributed System Security Symposium.
[86]
X. Yuan, Y. Chen, Y. Zhao, Y. Long, X. Liu, K. Chen, S. Zhang, H. Huang, X. Wang, and C. A. Gunter. 2018. CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In USENIX Security Symposium.
[87]
G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu. 2017. Dolphinattack: Inaudible voice commands. In ACM conference on computer and communications security.
[88]
J. Zhang, A. R. Beresford, and I. Sheret. 2019. SensorID: Sensor Calibration Fingerprinting for Smartphones. In IEEE Symposium on Security and Privacy.
[89]
Y. Zhang and K. Rasmussen. 2020. Detection of electromagnetic interference attacks on sensor systems. In IEEE Symposium on Security and Privacy.

Cited By

View all

Index Terms

  1. KITE: Exploring the Practical Threat from Acoustic Transduction Attacks on Inertial Sensors

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      SenSys '22: Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems
      November 2022
      1280 pages
      ISBN:9781450398862
      DOI:10.1145/3560905
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 24 January 2023

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. IoT security
      2. acoustic transduction attacks
      3. cyber-physical system
      4. inertial sensors
      5. spoofing attacks

      Qualifiers

      • Research-article

      Funding Sources

      Conference

      Acceptance Rates

      SenSys '22 Paper Acceptance Rate 52 of 187 submissions, 28%;
      Overall Acceptance Rate 174 of 867 submissions, 20%

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)131
      • Downloads (Last 6 weeks)11
      Reflects downloads up to 28 Dec 2024

      Other Metrics

      Citations

      Cited By

      View all

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media