PowerRadio: Manipulate Sensor Measurementvia Power GND Radiation

TL;DR

PowerRadio introduces a novel attack method that manipulates sensor readings remotely by exploiting ground wiring and circuit asymmetries, bypassing existing protections and affecting various sensor types.

Contribution

This paper uncovers PowerRadio, a new threat vector that manipulates sensors via power ground radiation, providing methods, principles, and validation across multiple systems.

Findings

Successfully manipulated surveillance camera images

Injected inaudible voice commands into microphones

Validated attacks on diverse sensors and systems

Abstract

Sensors are key components enabling various applications, e.g., home intrusion detection and environmental monitoring. While various software defenses and physical protections are used to prevent sensor manipulation, this paper introduces a new threat vector, PowerRadio, that bypasses existing protections and changes sensor readings from a distance. PowerRadio leverages interconnected ground (GND) wires, a standard practice for electrical safety at home, to inject malicious signals. The injected signal is coupled by the sensor's analog measurement wire and eventually survives the noise filters, inducing incorrect measurement. We present three methods to manipulate sensors by inducing static bias, periodical signals, or pulses. For instance, we show adding stripes into the captured images of a surveillance camera or injecting inaudible voice commands into conference microphones. We study the underlying principles of PowerRadio and identify its root causes: (1) the lack of shielding between ground and data signal wires and (2) the asymmetry of circuit impedance that enables interference to bypass filtering. We validate PowerRadio against a surveillance system, broadcast systems, and various sensors. We believe that PowerRadio represents an emerging threat, exhibiting the advantages of both radiated and conducted EMI, e.g., expanding the effective attack distance of radiated EMI yet eliminating the requirement of line-of-sight or approaching physically. Our insights shall provide guidance for enhancing the sensors' security and power wiring during the design phases.