Automated analysis of the effects induced by radio-frequency pulses on embedded systems for EMC Functional Safety

Kasmi, Chaouki; Lopes-Esteves, José

doi:10.1109/ursi-at-rasc.2015.7303039

Cited by 8 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In previous literature, abundant detection/mitigation methods against electromagnetic signal injection attacks have been proposed for various systems: for example, adding extra detection circuits to spot attacks by monitoring abnormal electromagnetic activities [1,2,11,50], encoding critical signals secretly and detecting attacks if the signal integrity corrupts [26,42,48,56], or, exploiting measurements from sensors plus tricky algorithms to detect/mitigate attacks [15,23,24,34,51]. Similar ideas theoretically apply to differential signaling, but millions of devices are not yet protected from the electromagnetic signal injection attacks.…”

Section: Future Countermeasuresmentioning

confidence: 99%

Electromagnetic Signal Injection Attacks on Differential Signaling

Zhang

Rasmussen

2023

Proceedings of the ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Differential signaling is a method of data transmission that uses two complementary electrical signals to encode information. This allows a receiver to reject any noise by looking at the difference between the two signals, assuming the noise affects both signals equally. Many protocols such as USB, Ethernet, and HDMI use differential signaling to achieve a robust communication channel in a noisy environment. This generally works well and has led many to believe that it is infeasible to remotely inject attacking signals into such a differential pair. In this paper, we challenge this assumption and show that an adversary can in fact inject malicious signals from a distance, purely using common-mode injection, i.e., injecting into both wires at the same time.We explain in detail the principles that an attacker can exploit to achieve a successful injection of an arbitrary bit, and we analyze the success rate of injecting longer arbitrary messages. We demonstrate the attack on a real system and show that the success rate can reach as high as 90%. Finally, we present a case study where we wirelessly inject a message into a Controller Area Network (CAN) bus, which is a differential signaling bus protocol used in many critical applications, including the automotive and aviation sector. CCS CONCEPTS• Security and privacy → Embedded systems security.

show abstract

Section: Future Countermeasuresmentioning

confidence: 99%

Electromagnetic Signal Injection Attacks on Differential Signaling

Zhang

Rasmussen

2023

Proceedings of the ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…In addition, in specific devices such as cardiac implantable electrical devices (CIED) [25] and smartphones [45], researchers utilized users' reactions or behaviors while using these devices to identify the existence of attacks on the sensors. A few works mentioned that multiple built-in sensors of a device can react to variations of the electromagnetic environment, and the characteristics can be exploited to detect abnormal electromagnetic activities [21,22]. Such a detection approach is also known as sensor fusion, which has been widely studied to detect signal injections that use other types of attacking signals such as ultrasonics and lasers [16,48].…”

Section: Detectionmentioning

confidence: 99%

Detection of Electromagnetic Signal Injection Attacks on Actuator Systems

Zhang¹,

Rasmussen²

2022

Preprint

View full text Add to dashboard Cite

An actuator is a device that converts electricity into another form of energy, typically physical movement. They are absolutely essential for any system that needs to impact or modify the physical world, and are used in millions of systems of all sizes, all over the world, from cars and spacecraft to factory control systems and critical infrastructure. An actuator is a "dumb device" that is entirely controlled by the surrounding electronics, e.g., a microcontroller, and thus cannot authenticate its control signals or do any other form of processing. The problem we look at in this paper is how the wires that connect an actuator to its control electronics can act like antennas, picking up electromagnetic signals from the environment. This makes it possible for a remote attacker to wirelessly inject signals (energy) into these wires to bypass the controller and directly control the actuator.To detect such attacks, we propose a novel detection method that allows the microcontroller to monitor the control signal and detect attacks as a deviation from the intended value. We have managed to do this without requiring the microcontroller to sample the signal at a high rate or run any signal processing. That makes our defense mechanism practical and easy to integrate into existing systems. Our method is general and applies to any type of actuator (provided a few basic assumptions are met), and can deal with adversaries with arbitrarily high transmission power. We implement our detection method on two different practical systems to show its generality, effectiveness, and robustness.

show abstract

“…3) Configuration settings: A better granularity in the user settings could be a great improvement: Letting the user choose his own keyword (already possible on most of devices but few users are doing so), disabling the voice interface by default, allowing the user to finely choose the authorized applications and actions via this interface, especially those accessible before the lock screen authentication process, would be interesting options. 4) Unusual EM activity detection: Recently, it has been shown that the many built-in sensors present in smartphones react to variations of the EM field nearby the device [19]. This characteristic could be used in order to monitor and detect any abnormal EM activity around the smartphone when a voice command is being processed, resulting in a rejection of the command when a suspicious activity is detected.…”

Section: B Countermeasuresmentioning

confidence: 99%

IEMI Threats for Information Security: Remote Command Injection on Modern Smartphones

Kasmi

Esteves

2015

IEEE Trans. Electromagn. Compat.

View full text Add to dashboard Cite

Numerous papers dealing with the analysis of electromagnetic attacks against critical electronic devices have been made publicly available. In this paper, we exploit the principle of front-door coupling on smartphones headphone cables with specific electromagnetic waveforms. We present a smart use of intentional electromagnetic interference, resulting in finer impacts on an information system than a classical denial of service effect. As an outcome, we introduce a new silent remote voice command injection technique on modern smartphones.Index Terms-Electronic warfare, information security, intentional electromagnetic interference.

show abstract

Automated analysis of the effects induced by radio-frequency pulses on embedded systems for EMC Functional Safety

Cited by 8 publications

References 0 publications

Electromagnetic Signal Injection Attacks on Differential Signaling

Electromagnetic Signal Injection Attacks on Differential Signaling

Detection of Electromagnetic Signal Injection Attacks on Actuator Systems

IEMI Threats for Information Security: Remote Command Injection on Modern Smartphones

Contact Info

Product

Resources

About