Presented at
Black Hat USA 2019,
Aug. 7, 2019, 11:15 a.m.
(50 minutes).
Electric motors (EMs) account for more than 40 percent of annual global electricity consumption and an estimated market size of $214 Billion by 2025. They drive autonomous vehicles and transportation systems, precisely control robotic movements in industrial systems, and even vibrate your phone. They are ubiquitous and they are controlled by hardware and software. Attacks targeting EMs bridge the gap between cyber space and the physical world, resulting in real-world damage.
To manage safety and security risks in cyber-physical systems with EM actuators, it is necessary to identify what attack objectives may exist against these components and determine what controls are required to mitigate these risks. Thus, our research aims to provide a comprehensive evaluation of cyber-attack objectives against EMs, which we don't believe has been done before in research, to provide risk assessors with new ideas to find vulnerabilities.
We conducted a wide-scale analysis of EMs, researching different EMs and case studies of their application in real-world SCADA and transportation systems. We analyze different attack objectives against EMs based on system type and provide examples of attack techniques that can achieve the objective. Types of failures include loss of control, wearing down components, limiting torque, over-rotating servo motors, fire, and some really unintentional impacts of messing with Pulse Width Modulation (PWM). Attack techniques to achieve these outcomes are both based on previous research and have not been presented before. They include pin-control attacks disrupting PWM, DOS or injection network attacks, sensor attacks, and exploiting the lack of security controls of software libraries on the controller.
Presenters:
-
Matthew Jablonski
- Research Assistant, GMU's Radar and Radio Engineering Lab
Mr. Jablonski is a Information Technology Ph.D. student currently working as a Research Assistant at George Mason University's Radar and Radio Engineering Lab (RARE Lab). His research focus areas include safety and security in cyber-physical systems, railroad communications security, reverse engineering, and embedded systems. Mr. Jablonski also works in industry as a Cybersecurity Engineer, focused on penetration testing and identifying and mitigating novel vulnerabilities.
-
Duminda Wijesekera
- Professor, Department of Computer Science at George Mason University
Duminda Wijesekera is a professor in the Department of Computer Science at George Mason University, Fairfax, Virginia and a visiting research scientist at the National Institute of Standards and Technology (NIST). He leads the Laboratory of Radio and RADAR Engineering (RARE), a collaboration between academia, industry and government located at GMU. His current research addresses multiple areas. The first is the security and safety of cyber physical systems. Research in this area includes safety and security of Intelligent Transportation Systems (ITS) that includes trains, aircraft, ships and automobiles and creating secure cognitive radio networks that ensure mandated safety guarantees for these transportation modes. He also collaborates on systems and communication security of power grids. A second area of his emerging research is connected autonomous vehicles. In this area, he works with his graduate students in developing models and protocols to disseminate stability related information in real time to enable corporate safety and message deliver, processing and integrity validation. This also links with multi-modal transport systems with application to seamless parking and pickup services by small -scale autonomous fleets. In addition, he is leading research work in adversarial activity detection in Deep Learning systems as most sensor systems used in autonomous vehicles depend on sensory inputs from cameras, Thermal Images, RADARS, LiDAR and Sonar devices. These devices use learning systems for obstacle detection and road scenery understanding. Another area of research is his work in digital forensics, where he leads his graduate students in creating potential scenarios from evidence and creating frameworks for argumentations, error management of forensic data and add odds ratio between different scenarios that fit evidence. He is a visiting research scientist at the National Institute of Standards and Technology (NIST) and a fellow at the Potomac Institute of Policy Studies in Arlington, VA. He holds courtesy appointments as and a member of the Center for Command, Control and Coordination (C4I) and as a co-director of the Center for Assurance Research (CARE) at George Mason University.
Links:
Similar Presentations: