Towards Adversarial Process Control on Inertial Sensor Systems with Physical Feedback Side Channels

Real-world process control requires continuous sensor measurements and automatic control of the environment. Typical process control systems consist of three main components: controllers functioning as the system's "brain'', sensors acting as measurement devices, and final control elements that modify the environment. Prior works showed that adversaries could inject signals into analog sensors to affect the control process; however, an adversarial controller that is necessary to achieve process control is inherently missing in conventional physical-level sensor signal injection attacks, which revealed mechanisms to perturb sensor systems but did not describe the computations necessary to adjust and regulate the process over time. This paper introduces an adversarial control loop approach that computes attack signals during the attack to guide the adversarial process control. Our approach allows constructing the external "brain'' of the adversarial process control with programs. Further, we characterize the Physical Feedback Side Channel (PFSC) in out-of-band signal injection attacks, and study how the adversarial prototype system can be constructed non-invasively to gain control over two types of inertial sensor-actuator systems, including a MegaWheels self-balancing scooter. We demonstrate proof-of-concept process control without accessing or tampering with internal modules of the victim system.