Recording the Voice MICROPHONES Vowels and Consonants MICROPHONES.
6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control...
Transcript of 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control...
![Page 1: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/1.jpg)
6.S062: Mobile and Sensor Computing
Lecture14:IoTSecurityPhysicalSecurityandAcous9cA:acks
Some material adapted from Nirupam Roy (UIUC)
![Page 2: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/2.jpg)
Mobile Security Inaudible Voice Commands
![Page 3: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/3.jpg)
![Page 4: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/4.jpg)
![Page 5: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/5.jpg)
Analog Sensor Security Acoustic Attacks on MEMS
Accelerometers
![Page 6: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/6.jpg)
![Page 7: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/7.jpg)
![Page 8: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/8.jpg)
![Page 9: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/9.jpg)
Drone Security Spoofing GPS Signals
![Page 10: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/10.jpg)
![Page 11: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/11.jpg)
Pacemaker Security Wireless Control of Pacemaker
![Page 12: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/12.jpg)
![Page 13: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/13.jpg)
BackDoor: Making Microphones Hear Inaudible Sounds
![Page 14: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/14.jpg)
Microphones are everywhere
![Page 15: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/15.jpg)
Microphones are everywhere
![Page 16: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/16.jpg)
Speaker
Audible sound
Microphones record audible sounds
I hear that
I record that
![Page 17: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/17.jpg)
Inaudible, but recordable !
Speaker
![Page 18: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/18.jpg)
Inaudible, but recordable !
Speaker
I can’t hear that
I record that
![Page 19: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/19.jpg)
Speaker
Works with unmodified devices
CameraSmartwatch
Laptop Hearing Aid
![Page 20: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/20.jpg)
Near-ultrasound
It’s not “near-ultrasound”
50k40k10k
Ampl
itud
e
Frequency20k 30k
![Page 21: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/21.jpg)
Microphonehardware
Exploiting fundamental nonlinearity
50k40k10k
Ampl
itud
e
20k 30k Frequency
![Page 22: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/22.jpg)
What can we do with it?
![Page 23: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/23.jpg)
Application: Acoustic jammer
![Page 24: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/24.jpg)
Application: Acoustic communication
$ 5.00
![Page 25: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/25.jpg)
Threat: Acoustic DOS attack
![Page 26: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/26.jpg)
Jamminghearing aids
Threat: Acoustic DOS attack
![Page 27: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/27.jpg)
Jamminghearing aids
Threat: Acoustic DOS attack
Blocking911 calls
![Page 28: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/28.jpg)
Talk outline
Microphone Overview1
System Design2
Challenges3
Evaluation4
![Page 29: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/29.jpg)
Talk outline
Microphone Overview1
System Design2
Challenges3
Evaluation4
![Page 30: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/30.jpg)
Microphone working principle
Amplifier Filter ADCDiaphragm
![Page 31: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/31.jpg)
Microphone working principle
Diaphragm Amplifier Filter ADC
![Page 32: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/32.jpg)
Microphone working principle
Amplifier Filter ADC
Ampl
itud
e
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
![Page 33: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/33.jpg)
Microphone working principle
Amplifier Filter ADC
Ampl
itud
e
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
![Page 34: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/34.jpg)
Microphone working principle
Amplifier Filter ADC
Ampl
itud
e
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
![Page 35: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/35.jpg)
Microphone working principle
Amplifier Filter ADC
Ampl
itud
e
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
![Page 36: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/36.jpg)
Microphone working principle
Amplifier Filter ADC
Microphone filter
Diaphragm
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Ampl
itud
e
![Page 37: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/37.jpg)
Diaphragm
Microphone working principle
Amplifier Filter ADC
Microphone filter
Ampl
itud
e
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 38: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/38.jpg)
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin
InputOut
put
Vout = a1Vin+ a2Vin2+ a3Vin
3+…
Amplifier
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 39: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/39.jpg)
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
InputOut
put
Vout = a1Vin+ a2Vin2
Amplifier
![Page 40: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/40.jpg)
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin
10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
InputOut
put
Amplifier
Vout = a1Vin+ a2Vin2
![Page 41: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/41.jpg)
Talk outline
Microphone Overview1
System Design2
Challenges3
Evaluation4
![Page 42: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/42.jpg)
Exploiting amplifier non-linearityAm
plit
ude Microphone
filter
F1= 50kHzF2= 40kHz
F1F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 43: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/43.jpg)
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearityAm
plit
ude Microphone
filter
F1= 50kHzF2= 40kHz
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 44: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/44.jpg)
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearityAm
plit
ude Microphone
filter
F1= 50kHzF2= 40kHz
F1F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
2F2 (F1+F2) 2F1
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 45: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/45.jpg)
2F2 (F1+F2) 2F1
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearityAm
plit
ude F1F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1= 50kHzF2= 40kHz
Microphone filter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 46: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/46.jpg)
2F2 (F1+F2) 2F1
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearityAm
plit
ude F1F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1= 50kHzF2= 40kHz
Microphone filter
(F1-F2)
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
![Page 47: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/47.jpg)
Exploiting amplifier non-linearityAm
plit
ude F1F2
F1= 50kHzF2= 40kHz
Microphone filter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 100k90k
(F1-F2)
![Page 48: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/48.jpg)
Exploiting amplifier non-linearityAm
plit
ude F1F2
F1= 50kHzF2= 40kHz
Microphone filter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
(F1-F2)
![Page 49: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/49.jpg)
Talk outline
Microphone Overview1
System Design2
Challenges3
Evaluation4
![Page 50: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/50.jpg)
Challenges
Ultrasonic speaker
Amplitude modulation
Problem: speaker has non-linearities=> Audible sound
![Page 51: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/51.jpg)
Challenges
Ultrasonic speaker
Frequency modulation
Wenyuan Xu
![Page 52: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/52.jpg)
Primer on Modulation
![Page 53: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/53.jpg)
![Page 54: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/54.jpg)
![Page 55: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/55.jpg)
![Page 56: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/56.jpg)
![Page 57: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/57.jpg)
Challenges
Ultrasonic speaker
Frequency modulation
Wenyuan Xu
![Page 58: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/58.jpg)
![Page 59: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/59.jpg)
2
![Page 60: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/60.jpg)
Challenges
Ultrasonic speaker
Frequency modulation
Problem: microphone can’t measure
inaudible sound
Wenyuan Xu
![Page 61: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/61.jpg)
Solution?
Ultrasonic speaker
Add another speaker How do we structure its
signal?
![Page 62: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/62.jpg)
![Page 63: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/63.jpg)
Talk outline
Microphone Overview1
System Design2
Challenges3
Evaluation4
![Page 64: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/64.jpg)
Hardware generalizability
40 kHz
50 kHz
Hearing Aid
Camera iPhone Androidphone
Smartwatch Laptop
Hearing!aids!
Camera!
iPhone!
Android!phone!
Smart-w
atch!
Laptop!
BackDoor!Signal!(dB)!
Devices!
60!
40!
20!
0!
![Page 65: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/65.jpg)
Implementation
Communication prototype
Jammerprototype
![Page 66: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/66.jpg)
Communication performance
FM data packets
4kbpsup to 1 meter
More power can increase the distance
![Page 67: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/67.jpg)
Jamming performance
BackDoor jammer
Spymicrophone
![Page 68: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/68.jpg)
Jamming performance
BackDoor jammer
Spymicrophone
![Page 69: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/69.jpg)
Jamming performance
BackDoor jammer
Spymicrophone
![Page 70: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/70.jpg)
Jamming performance
BackDoor jammer
Spymicrophone
![Page 71: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/71.jpg)
Jamming performance
BackDoor jammer
Spymicrophone
![Page 72: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/72.jpg)
Jamming performance
BackDoor jammer
Jammed recording
2000 spoken words
![Page 73: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/73.jpg)
Jamming performance
BackDoor jammer
Jammed recording
Humanlistener
Speech recognition
2000 spoken words
![Page 74: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/74.jpg)
Jamming performance
BackDoor jammer
Jammed recording
Humanlistener
Speech recognition
% of legible words
2000 spoken words
![Page 75: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/75.jpg)
Jamming performance100
80
60
40
20
0
1.0m
1.5m
2.0m
No Jam2.5m
3.0m
3.5m
4.0m
4.5m
5.0m
Jamming distance
Legi
bilit
y of
wor
ds (%
)Human users
Automatic speech recognition
![Page 76: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/76.jpg)
How would you design a system to secure against this attack?
![Page 77: 6.S062: Mobile and Sensor Computing · Spoofing GPS Signals. Pacemaker Security Wireless Control of Pacemaker. BackDoor: Making Microphones Hear Inaudible Sounds . Microphones are](https://reader033.fdocuments.net/reader033/viewer/2022050208/5f5a90f10bd4b748b93cb008/html5/thumbnails/77.jpg)
Summary
•IoT Security: both digital and analog •“Sensor” security & attacks:
- Mobile acoustic attacks (inaudible voice commands) - Analog Sensor attacks (on MEMS accelerometers) - Drone Security (Spoofing GPS) - Medical Security (Hacking Pacemakers)
•Modulation schemes - AM - FM - Inter-modulation
•Fundamentals have implications beyond IoT (e.g., Cuban “acoustic attack”)