Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors

Sensing and actuation systems contain sensors to observe the environment and actuators to influence it. However, these sensors can be tricked by maliciously fabricated physical properties. In this paper, we investigated whether an adversary could incapacitate drones equipped with Micro-Electro-Mechanical Systems (MEMS) gyroscopes using intentional sound noise. While MEMS gyroscopes are known to have resonant frequencies that degrade their accuracy, it is not known whether this property can be exploited maliciously to disrupt the operation of drones. We first tested 15 kinds of MEMS gyroscopes against sound noise and discovered the resonant frequencies of seven MEMS gyroscopes by scanning the frequencies under 30 kHz using a consumer-grade speaker. The standard deviation of the resonant output from those gyroscopes was dozens of times larger than that of the normal output. After analyzing a target drone's flight control system, we performed real-world experiments and a software simulation to verify the effect of the crafted gyroscope output. Our real-world experiments showed that in all 20 trials, one of two target drones equipped with vulnerable gyroscopes lost control and crashed shortly after we started our attack. A few interesting applications and countermeasures are discussed at the conclusion of this paper.

[1]  A Koestler,et al.  Ghost in the Machine , 1970 .

[2]  T. Shallice.  What ghost in the machine? , 1992, Nature.

[3]  N. C. MacDonald,et al.  Capacitance Based Tunable Micromechanical Resonators , 1995, Proceedings of the International Solid-State Sensors and Actuators Conference - TRANSDUCERS '95.

[4]  J. Fowlkes,et al.  Section 4‐‐bioeffects in tissues with gas bodies. American Institute of Ultrasound in Medicine. , 2000, Journal of ultrasound in medicine : official journal of the American Institute of Ultrasound in Medicine.

[5]  Satoshi Hoshino,et al.  Impact of artificial "gummy" fingers on fingerprint systems , 2002, IS&T/SPIE Electronic Imaging.

[6]  Seonho Seok,et al.  A study on resonant frequency and Q factor tunings for MEMS vibratory gyroscopes , 2004 .

[7]  S. Nasiri.  A Critical Review of MEMS Gyroscopes Technology and Commercialization Status , 2005 .

[8]  George T. Flowers,et al.  Influence of Acoustic Noise on the Dynamic Performance of MEMS Gyroscopes , 2007 .

[9]  G.T. Flowers,et al.  On the Degradation of MEMS Gyroscope Performance in the Presence of High Power Acoustic Noise , 2007, 2007 IEEE International Symposium on Industrial Electronics.

[10]  Alessandra Lumini,et al.  Fake fingertip generation from a minutiae template , 2008, 2008 19th International Conference on Pattern Recognition.

[11]  Nguyen Minh Duc.  Your face is NOT your password Face Authentication ByPassing Lenovo – Asus – Toshiba , 2009 .

[12]  Grant Roth,et al.  Simulation of the Effects of Acoustic Noise on MEMS Gyroscopes , 2009 .

[13]  George T. Flowers,et al.  A Characterization of the Performance of a MEMS Gyroscope in Acoustically Harsh Environments , 2011, IEEE Transactions on Industrial Electronics.

[14]  Jana Dittmann,et al.  AR.Drone: security threat analysis and exemplary attack to track persons , 2012, Electronic Imaging.

[15]  Romit Roy Choudhury,et al.  Tapprints: your finger taps have fingerprints , 2012, MobiSys '12.

[16]  Hao Chen,et al.  On the Practicality of Motion Based Keystroke Inference Attack , 2012, TRUST.

[17]  George T. Flowers,et al.  Mitigation of the Effects of High Levels of High-Frequency Noise on MEMS Gyroscopes Using Microfibrous Cloth , 2013 .

[18]  Paulo Tabuada,et al.  Non-invasive Spoofing Attacks for Anti-lock Braking Systems , 2013, CHES.

[19]  Wenyuan Xu,et al.  Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors , 2013, 2013 IEEE Symposium on Security and Privacy.

[20]  Angelos D. Keromytis,et al.  From the Aether to the Ethernet - Attacking the Internet using Broadcast Digital Television , 2014, USENIX Security Symposium.

[21]  Gabi Nakibly,et al.  Gyrophone: Recognizing Speech from Gyroscope Signals , 2014, USENIX Security Symposium.