Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors

Abstract

Electromagnetic interference (EMI) affects circuits by inducing voltages on conductors. Analog sensing of signals on the order of a few millivolts is particularly sensitive to interference. This work (1) measures the susceptibility of analog sensor systems to signal injection attacks by intentional, low-power emission of chosen electromagnetic waveforms, and(2) proposes defense mechanisms to reduce the risks.Our experiments use specially crafted EMI at varying power and distance to measure susceptibility of sensors in implantable medical devices and consumer electronics. Results show that at distances of 1-2 m, consumer electronic devices containing microphones are vulnerable to the injection of bogus audio signals. Our measurements show that in free air, intentional EMI under 10 W can inhibit pacing and induce defibrillation shocks at distances up to 1-2 m on implantable cardiac electronic devices. However, with the sensing leads and medical devices immersed in a saline bath to better approximate the human body, the same experiment decreased to under 5 cm.Our defenses range from prevention with simple analog shielding to detection with a signal contamination metric based on the root mean square of waveform amplitudes. Our contribution to securing cardiac devices includes a novel defense mechanism that probes for forged pacing pulses inconsistent with the refractory period of cardiac tissue.

Patient Infusion Pattern based Access Control Schemes for Wireless Insulin Pump System

“…Paper [37] identifies a set of safety requirement that can be formally verified against pump software. Measurements in paper [31] show that in free air, intentional EMI under 10 W can inhibit pacing and induce defibrillation shocks at distances up to 1 -2 m on implantable cardiac electronic devices.…”

“…Kevin Fu et al detailed how to reprogram an implantable cardiac defibrillator remotely, causing the victim to receive a malicious shock [10]. Measurements in another paper [31] show that in free air, intentional EMI under 10 W can inhibit pacing and induce defibrillation shocks at distances up to 1 -2 m on implantable cardiac electronic devices. Additionally, harvesting patient data in the region is easily executed via an eavesdropping attack.…”

Computer Security – ESORICS 2019

“…Ever since a 2013 paper by Kune et al showed that electromagnetic (EM) signals can be used to cause medical devices to deliver defibrillation shocks [10], there has been a rise in EM, acoustic, and optical signal injection attacks against sensor and actuator systems [7]. Although some papers have focused on vulnerabilities caused by the ADC sampling process itself [2], others have focused on exploiting the control algorithms that make use of the digitized signal.…”

“…The integrity of these sensor outputs is crucial, as many security-critical decisions are taken in response to the sensor values. However, specially-crafted adversarial signals can be used to remotely induce waveforms into the outputs of sensors, thereby attacking pacemakers [10], temperature sensors [5], smartphone microphones [9], and carbraking mechanisms [20]. These attacks cause a system to report values which do not match the true sensor measurements, and trick it into performing dangerous actions such as raising false alarms, or even delivering defibrillation shocks.…”

Preservation of Implanted Medical Device's Battery Power

“…In case of any malfunction of the vital organs of the body an immediate notification is sent to the personal device to alert the patient to take appropriate measures [5]. For example, consider the glucose level of the patient is very high.…”