ConfuSense: Sensor Reconfiguration Attacks for Stealthy UAV Manipulation
summary
ConfuSense shows that a single injected bus message can reconfigure IMUs (via a malicious supply-chain chip or EMI-manipulated write) to trigger suspend power-save or slow sensor below 400 Hz, which stalls the EKF and pauses ArduPilot tasks. Experiments with an MPU6050 on a Raspberry and three flight controllers (four IMUs) produce undetected crashes, up to 138 m deviation and targeted 30 m diversion using a reinforcement-learning attack synthesis, and current detectors miss or detect too late.
AI-written summary · about
chapters (11)
- 0:00ConfuSense project intro
- 1:55Sensor-flight controller comms
- 3:42Sensor reconfiguration attacks
- 5:29Hardware behavior under attack
- 8:03Local attack via hardware supply
- 9:04Remote attack via EMI interference
- 10:10Attack impact on controllers
- 12:42Software-in-the-loop results
- 14:03Attack synthesis with RL
- 14:44Detecting and mitigating attacks
- 16:30Conclusion & Q&A
related talks
13mBlind Spot in Sensor Fusion: Exploiting an Architectural Vulnerability to Hijack...
30mThe Motion Sensor Western: The Good, the Bad, and the Ugly
21mInjected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
20mSLEIGHT: Real-time Closed-Loop Attack Analytics Framework for Holistic Intrusion...
45mAnalogy Cyber Security—From 0101 to Mixed Signals
47mMiniaturization
50mNavigating Chaos: The Consequences of Compromise in Mixed-Autonomy Freeways
16mPerspective-Shift Attacks Against Optical Perception Sensors: A Novel Attack...