Temperature sensing and control systems are widely used in the closed-loop control of critical processes such as maintaining the thermal stability of patients, or in alarm systems for detecting temperature-related hazards. However, the security of these systems has yet to be completely explored, leaving potential attack surfaces that can be exploited to take control over critical systems. In this paper we investigate the reliability of temperature-based control systems from a security and safety perspective. We show how unexpected consequences and safety risks can be induced by physical-level attacks on analog temperature sensing components. For instance, we demonstrate that an adversary could remotely manipulate the temperature sensor measurements of an infant incubator to cause potential safety issues, without tampering with the victim system or triggering automatic temperature alarms. This attack exploits the unintended rectification effect that can be induced in operational and instrumentation amplifiers to control the sensor output, tricking the internal control loop of the victim system to heat up or cool down. Furthermore, we show how the exploit of this hardware-level vulnerability could affect different classes of analog sensors that share similar signal conditioning processes. Our experimental results indicate that conventional defenses commonly deployed in these systems are not sufficient to mitigate the threat, so we propose a prototype design of a low-cost anomaly detector for critical applications to ensure the integrity of temperature sensor signals.
Analog circuits of sensors are especially susceptible to EMI. Various works show how is possible exploit different non-linearities of circuit components to cause sensors misreadings. Foo @cite_56 showed that bogus signals can be injected into analog sensors such as microphones and electrocardiogram (ECG) sensors in proximity through low-power EMI. Their amplitude-modulated EMI attack method exploited the generation of subharmonics caused by the passage of high frequency signals through common circuit components (e.g. capacitors in the path between the microphones and the amplifier).
@cite_56
2151370481 2909789829 2805972105 2913715209
Electromagnetic interference (EMI) affects circuits by inducing voltages on conductors. Analog sensing of signals on the order of a few millivolts is particularly sensitive to interference. This work (1) measures the susceptibility of analog sensor systems to signal injection attacks by intentional, low-power emission of chosen electromagnetic waveforms, and (2) proposes defense mechanisms to reduce the risks. Our experiments use specially crafted EMI at varying power and distance to measure susceptibility of sensors in implantable medical devices and consumer electronics. Results show that at distances of 1-2m, consumer electronic devices containing microphones are vulnerable to the injection of bogus audio signals. Our measurements show that in free air, intentional EMI under 10 W can inhibit pacing and induce defibrillation shocks at distances up to 1-2m on implantable cardiac electronic devices. However, with the sensing leads and medical devices immersed in a saline bath to better approximate the human body, the same experiment decreases to about 5 cm. Our defenses range from prevention with simple analog shielding to detection with a signal contamination metric based on the root mean square of waveform amplitudes. Our contribution to securing cardiac devices includes a novel defense mechanism that probes for forged pacing pulses inconsistent with the refractory period of cardiac tissue. Sensors are embedded in security-critical applications from medical devices to nuclear power plants, but their outputs can be spoofed through signals transmitted by attackers at a distance. To address the lack of a unifying framework for evaluating the effect of such transmissions, we introduce a system and threat model for signal injection attacks. Our model abstracts away from specific circuit-design issues, and highlights the need to characterize the response of Analog-to-Digital Converters (ADCs) beyond their Nyquist frequency. This ADC characterization can be conducted using direct power injections, reducing the amount of circuit-specific experiments to be performed. We further define the concepts of existential, selective, and universal security, which address attacker goals from mere disruptions of the sensor readings to precise waveform injections. As security in our framework is not binary, it allows for the direct comparison of the level of security between different systems. We additionally conduct extensive experiments across all major ADC types, and demonstrate that an attacker can inject complex waveforms such as human speech into ADCs by transmitting amplitude-modulated (AM) signals over carrier frequencies up to the GHz range. All ADCs we test are vulnerable and demodulate the injected AM signal, although some require a more fine-tuned selection of the carrier frequency. We finally introduce an algorithm which allows circuit designers to concretely calculate the security level of real systems, and we apply our definitions and algorithm in practice using measurements of injections against a smartphone microphone. Overall, our work highlights the importance of evaluating the susceptibility of systems against signal injection attacks, and introduces both the terminology and the methodology to do so. Embedded and cyber-physical systems are critically dependent on the integrity of input and output signals for proper operation. Input signals acquired from sensors are assumed to correspond to the phenomenon the system is monitoring and responding to. Similarly, when such systems issue an actuation signal it is expected that the mechanism being controlled will respond in a predictable manner. Recent work has shown that sensors can be manipulated through the use of intentional electromagnetic interference (IEMI). In this work, we demonstrate thatboth input and output signals, analog and digital, can be remotely manipulated via the physical layer---thus bypassing traditional integrity mechanisms. Through the use of specially crafted IEMI it is shown that the physical layer signaling used for sensor input to, and digital communications between, embedded systems may be undermined to an attacker's advantage. Three attack scenarios are analyzed and their efficacy demonstrated. In the first scenario the analog sensing channel is manipulated to produce arbitrary sensor readings, while in the second it is shown that an attacker may induce bit flips in serial communications. Finally, a commonly used actuation signal is shown to be vulnerable to IEMI. The attacks are effective over appreciable distances and at low power. Research on how hardware imperfections impact security has primarily focused on side-channel leakage mechanisms produced by power consumption, electromagnetic emanations, acoustic vibrations, and optical emissions. However, with the proliferation of sensors in security-critical devices, the impact of attacks on sensor-to-microcontroller and microcontroller-to-actuator interfaces using the same channels is starting to become more than an academic curiosity. These out-of-band signal injection attacks target connections which transform physical quantities to analog properties and fundamentally cannot be authenticated, posing previously unexplored security risks. This paper contains the first survey of such out-of-band signal injection attacks, with a focus on unifying their terminology, and identifying commonalities in their causes and effects. The taxonomy presented contains a chronological, evolutionary, and thematic view of out-of-band signal injection attacks which highlights the cross-influences that exist and underscores the need for a common language irrespective of the method of injection. By placing attack and defense mechanisms in the wider context of their dual counterparts of side-channel leakage and electromagnetic interference, our paper identifies common threads and gaps that can help guide and inform future research. Overall, the ever-increasing reliance on sensors embedded in everyday commodity devices necessitates that a stronger focus be placed on improving the security of such systems against out-of-band signal injection attacks.