Miniaturization
summary
Demonstrates miniaturized SCADA attacks that fit inside commodity pressure sensors by extracting shock-wave timing and spoofing operator displays. Uses lightweight triangle strip matching to detect transients in noisy samples, a runs-analysis variant to recreate believable sensor noise, and micro-op + binary-normal-form + infinite-register transforms to merge payload into vendor firmware. Detector core weighs about 700 bytes, total exploit compresses to roughly 2.1 KB payload, proof-of-concept runs on MSP430-class devices with a noisy but working demo and 35% size savings on merged firmware.
AI-written summary · about
chapters (10)
- 0:00Introduction to water hammer
- 1:08Analyzing pressure transients
- 4:28Miniaturizing detection code
- 7:29Triangle matching algorithm
- 12:05Extracting wave signatures
- 16:11Spoofing operator data
- 18:41Regenerating sensor noise
- 23:26Binary analysis and merging
- 30:42Automating firmware injection
- 39:08Demonstration and conclusion
related talks
45mAnalogy Cyber Security—From 0101 to Mixed Signals
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
31mConquer the Enterprise from Inside
51mA Measured Response to a Grain of Rice
30mAffordable EMFI Attacks Against Modern IoT Chips
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
44mSilicon Under Attack Physical Exploitation Of Modern Chips
21mEnhanced Security for LoRaWAN devices