SoK: Understanding the Fundamentals and Implications of Sensor Out-of-band Vulnerabilities

TL;DR

This paper systematically analyzes sensor out-of-band vulnerabilities in cyber-physical systems, providing a comprehensive framework based on physical principles to understand attack surfaces and guide future security improvements.

Contribution

It introduces the first comprehensive systematization framework for sensor OOB vulnerabilities, analyzing them across component, sensor, and system levels.

Findings

Identifies physical principles behind OOB vulnerabilities.

Categorizes known sensor attacks and assesses their practicality.

Analyzes how CPS features influence OOB threat exposure.

Abstract

Sensors are fundamental to cyber-physical systems (CPS), enabling perception and control by transducing physical stimuli into digital measurements. However, despite growing research on physical attacks on sensors, our understanding of sensor hardware vulnerabilities remains fragmented due to the ad-hoc nature of this field. Moreover, the infinite attack signal space further complicates threat abstraction and defense. To address this gap, we propose a systematization framework, termed sensor out-of-band (OOB) vulnerabilities, that for the first time provides a comprehensive abstraction for sensor attack surfaces based on underlying physical principles. We adopt a bottom-up systematization methodology that analyzes OOB vulnerabilities across three levels. At the component level, we identify the physical principles and limitations that contribute to OOB vulnerabilities. At the sensor level, we categorize known attacks and evaluate their practicality. At the system level, we analyze how CPS features such as sensor fusion, closed-loop control, and intelligent perception impact the exposure and mitigation of OOB threats. Our findings offer a foundational understanding of sensor hardware security and provide guidance and future directions for sensor designers, security researchers, and system developers aiming to build more secure sensors and CPS.