Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses

Abstract

Recent research has shown that the integrity of sensor measurements can be violated through out-of-band signal injection attacks. These attacks target the conversion process from a physical quantity to an analog property-a process that fundamentally cannot be authenticated. Out-of-band signal injection attacks thus pose previously-unexplored security risks by exploiting hardware imperfections in the sensors themselves, or in their interfaces to microcontrollers. In response to the growingyet-disjointed literature in the subject, this article presents the first survey of out-of-band signal injection attacks. It focuses on unifying their terminology and identifying commonalities in their causes and effects through a chronological, evolutionary, and thematic taxonomy of attacks. By highlighting cross-influences between different types of out-of-band signal injections, this paper underscores the need for a common language irrespective of the attack method. By placing attack and defense mechanisms in the wider context of their dual counterparts of side-channel leakage and electromagnetic interference, this study identifies common threads and gaps that can help guide and inform future research. Overall, the ever-increasing reliance on sensors embedded in everyday commodity devices necessitates that a stronger focus be placed on improving the security of such systems against out-of-band signal injection attacks.

Computer Security – ESORICS 2019

“…Ever since a 2013 paper by Kune et al showed that electromagnetic (EM) signals can be used to cause medical devices to deliver defibrillation shocks [10], there has been a rise in EM, acoustic, and optical signal injection attacks against sensor and actuator systems [7]. Although some papers have focused on vulnerabilities caused by the ADC sampling process itself [2], others have focused on exploiting the control algorithms that make use of the digitized signal.…”

“…Using Equations (6) and (7), the similarity metric between the measured signal s f (t) and the ideal signal w(t) can be defined as follows: To sanity-check this metric and the experimental setup, an unmodulated 20 mV f m = 1 kHz signal is generated. Figure 9a shows this waveform as measured by the smartphone of Section 4.2 along with an ideal 1 kHz signal.…”

A Hamilton-Jacobi Equation for Evaluating EEMI Propagation in a Computing System

“…The convection term gives account of the change of F (t, x) as particles are transported from one point to the other with velocity u. If we go back to (1) and (2) and drop the max min operators, we end up with a partial differential equation very similar to 7, where the dot product ∇J T •ẋ is in the form of a convection term where the velocity term is given by the dynamics of the logic gate component. Broadly speaking, this HJI equation has similarity with a material derivative of some particular substance, in this case, the cost function.…”

“…A number of authors have reported exploitable erratic behavior on the execution of software under EEMI targeting a processor at particular points in time and space [2], [3] We have tampered with the execution of a program in assembler language for a processor in simulation [4]. We produced the same deviation in software execution assuming knowledge of the processor layout.…”

Simplified Flip-Flop Gate Model for EEMI Injection

“…The academic curiosity question of how the interaction of sensors/actuators with computing systems can render an adversarial vulnerability has evolved into practical relevance. There are various works where medical devices such as insulin injectors or pacemakers have been compromised to the point of reporting spurious levels of insulin, switching on/off the flow of insulin or producing shock commands [2]. Usually, these adversarial intrusions take advantage of the computing systems' ports of entry.…”