Why Lasers Inject Perceived Sound Into MEMS Microphones: Indications and Contraindications of Photoacoustic and Photoelectric Effects

Cyr, Benjamin; Sugawara, Takeshi; Fu, Kevin

doi:10.1109/sensors47087.2021.9639744

Cited by 4 publications

(3 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• P(x,t) represents the photoacoustic signal generated by the material Our study extends and diverges from prior works like LightCommands by demonstrating that various materials, not just microphone diaphragms, can generate photoacoustic signals [CSF21,Cyr23]. Table 7 illustrates that semiconductor materials and plastics, often used in MEMS and ECM microphone diaphragms, have higher photoacoustic coefficients, making them more susceptible to laser stimulation.…”

Section: Photoacoustic Effectsupporting

confidence: 55%

Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays

Shi,

He,

Wang

et al. 2024

TCHES

View full text Add to dashboard Cite

Voice-controlled (VC) systems, such as mobile phones and smart speakers, enable users to operate smart devices through voice commands. Previous works (e.g., LightCommands) show that attackers can trigger VC systems to respond to various audio commands by injecting light signals. However, LightCommands only discusses attacks on devices with a single microphone, while new devices typically use microphone arrays with sensor fusion technology for better capturing sound from different distances. By replicating LightCommands’s experiments on the new devices, we find that simply extending the light scope (just as they do) to overlap multiple microphone apertures is inadequate to wake up the device with sensor fusion. Adapting LightCommands’s approach to microphone arrays is challenging due to their requirement for multiple sound amplifiers, and each amplifier requires an independent power driver with unique settings. The number of additional devices increases with the microphone aperture count, significantly increasing the complexity of implementing and deploying the attack equipment. With a growing number of devices adopting sensor fusion to distinguish the sound location, it is essential to propose new approaches to adapting the light injection attacks to these new devices. To address these problems, we propose a lightweight microphone array laser injection solution called LCMA (Laser Commands for Microphone Array), which can use a single laser controller to manipulate multiple laser points and simultaneously target all the apertures of a microphone array and input light waves at different frequencies. Our key design is to propose a new PWM (Pulse Width Modulation) based control signal algorithm that can be implemented on a single MCU and directly control multiple lasers via different PWM output channels. Moreover, LCMA can be remotely configured via BLE (Bluetooth Low Energy). These features allow our solution to be deployed on a drone to covertly attack the targets hidden inside the building. Using LCMA, we successfully attack 29 devices. The experiment results show that LCMA is robust on the newest devices such as the iPhone 15, and the control panel of the Tesla Model Y.

show abstract

Section: Photoacoustic Effectsupporting

confidence: 55%

Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays

Shi,

He,

Wang

et al. 2024

TCHES

View full text Add to dashboard Cite

show abstract

“…Todorović [21] and several follow-up works by related researchers [22,23,24] investigated photoacoustic effects on silicon microstructures, noting several potential effects. Soon after Light Commands, we published a follow-up work indicating that photoacoustic effects on the diaphragm were the primary contributor to the laser injection signal [25]. While [25] showed the presence of photoacoustic phenomena, it did not provide a concrete model to describe the phenomena.…”

Section: Introductionmentioning

confidence: 99%

“…Soon after Light Commands, we published a follow-up work indicating that photoacoustic effects on the diaphragm were the primary contributor to the laser injection signal [25]. While [25] showed the presence of photoacoustic phenomena, it did not provide a concrete model to describe the phenomena. This model and understanding is a key part to developing future MEMS microphones that are resistant to laser signal injection.…”

Section: Introductionmentioning

confidence: 99%

How Lasers Exploit Photoacoustic and PhotoelectricPhenomena to Inject Signals into MEMS Microphones

Cyr,

Sumaria,

Long

et al. 2024

Preprint

Self Cite

View full text Add to dashboard Cite

An amplitude-modulated laser can be used to generate false, yet coherent acoustic signals on the outputs of MEMS microphones. While this vulnerability has ramifications on the security of cyber-physical systems that trust these microphones, the physical explanation of this effect remained a mystery. Without an understanding of the physical phenomena contributing to this signal injection, it is difficult to design effective and reliable defenses. In this work, we show the degree to which the mechanisms of thermoelastic bending, thermal diffusion, and photocurrent generation are used to inject signals into MEMS microphones. We provide models for each of these mechanisms, develop a procedure to empirically determine their relative contributions, and highlight the effects on eight commercial MEMS microphones. We accomplish this with a precise setup to isolate each mechanism using several laser wavelengths and a vacuum chamber. The results indicate that the injected signal on the microphone is dependent on the wavelength of the incoming light, where long wavelengths (such as a 904~nm infrared laser) exploit photoelectric effects on the ASIC, while short wavelengths (such as a 450~nm blue laser) exploit photoacoustic effects on the diaphragm and surrounding air. This understanding leads to recommendations for future laser-resistant microphone designs with improvements to glob top application, reducing the material asymmetries within the MEMS structure, and adding simple light or temperature sensors for injection detection. Based on the fundamental causality, we also suggest potential vulnerabilities within other sensors with similar characteristics to MEMS microphones, such as conventional microphones, ultrasonic sensors, and inertial sensors.

show abstract

Laser-Based Signal-Injection Attack on Piezoresistive MEMS Pressure Sensors

Tanaka

Sugawara

2022

2022 IEEE Sensors

View full text Add to dashboard Cite

Why Lasers Inject Perceived Sound Into MEMS Microphones: Indications and Contraindications of Photoacoustic and Photoelectric Effects

Cited by 4 publications

References 9 publications

Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays

Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays

How Lasers Exploit Photoacoustic and PhotoelectricPhenomena to Inject Signals into MEMS Microphones

Laser-Based Signal-Injection Attack on Piezoresistive MEMS Pressure Sensors

Contact Info

Product

Resources

About