In a notice about Defcon last week, Che Yunyu mentioned that a team with 360 will demonstrate how to make a wrong decision by semi-automatic driving system on the car by deception, or interference sensor.
This article refers to the address: http://
On Monday, Liu Jianwei, head of 360 Automotive Information Security Lab, and Xu Wenyuan, a professor/doctoral supervisor at Zhejiang University who was working on the subject together, and Yan Yan from Zhejiang University, jointly demonstrated on Defcon and introduced how to deceive Ultrasonic sensors, cameras and millimeter-wave radar on the Sla Model S.
The automatic driving, including the current semi-automatic driving, realizes the process of sensing the environment around the vehicle through various sensors installed on the vehicle, and the data is transmitted to the analysis processing unit, and the control unit judges according to the result sent by the analysis processing unit. In turn, commands are issued to the actuator of the vehicle to make different commands such as steering, acceleration, and braking.
Their entry point is in the first step, when the sensor senses the surrounding environment, doing some hands and feet, so that the sensor gets the wrong data.
How to interfere with the sensor?
The way different sensors interfere is naturally different. The three sensors in this study work differently, let's look at them one by one.
Ultrasonic sensor
The role of the ultrasonic sensor on the vehicle is to detect an obstacle. After the ultrasonic wave is emitted, the distance from the obstacle is judged based on the time when the echo is received. Tesla's Model S is equipped with 12 ultrasonic sensors around the body to detect obstacles around the vehicle, and will sound a warning after an obstacle is detected. There will be obstacles and distance indications on the corresponding position on the instrument panel. If Autopilot is turned on, the vehicle will automatically brake when the distance is too close.
The way to affect the ultrasonic sensor is very simple. One is to increase the signal-to-noise ratio of the echo received by the ultrasonic sensor by the noise of the ultrasonic wave to affect its judgment; the other is to send the ultrasonic wave of the same frequency to the ultrasonic sensor, which makes it mistakenly think that it is the original There are obstacles in places where there are no obstacles.
It is also very convenient to implement. It only needs an interference device costing 60 yuan, and it can send a corresponding signal in front of the ultrasonic sensor of the vehicle. From the results of the team research, if it is interfered by noise, it will affect the judgment of the ultrasonic wave on the distance, and the judgment result is not accurate, so the distance information displayed on the instrument panel is also wrong; and if it is issued by the same frequency The signal, then the sensor will make the opposite judgment.
After the interference, the sensor determines the distance error. If it is in the manual driving state, it will be misled by the error message displayed on the dashboard. If it is in the state of Autopilot, it will also be misled to make a wrong judgment, or error. A warning sounds that the system is not working must be taken over by the human driver. It should be noted that if the same frequency signal is emitted for interference, the time is very important. Only the first time the ultrasonic wave received by the sensor is effective and can have an effect.
The sensor fails to recognize the obstacle. Of course, there is also the easiest way to use the sound-absorbing material to absorb the ultrasonic waves from the sensor and directly strike it.
2. Millimeter wave radar
In contrast, the cracking of millimeter-wave radar is much more difficult. The most direct manifestation is in the cost of equipment. According to Liu Jianwei, the equipment cost of interfering with millimeter wave radar is 1.2 million yuan. However, due to safety considerations and the limitations of the power cord length of the equipment, the interference to the millimeter wave radar is not achieved under high-speed operation of the vehicle.
The theoretical interference distance of the millimeter wave radar is the detection distance of the millimeter wave, but the wireless millimeter wave launcher is rare and the cost is higher, which is also an attack on the millimeter wave radar which is more difficult to occur in reality.
The above figure of the interference device of the millimeter wave radar is a device that interferes with the millimeter wave radar. Liu Jianwei said that through the interference of electromagnetic waves, the sensor can be considered to have a car in the state without car in front, and this information will be displayed on the instrument panel synchronously. If the distance is close enough, the alarm device will also remind, also, in the Autopilot state, Will automatically brake. Similarly, you can let the system think that there is no car ahead and continue driving when there is a car in front.
The error display of the instrument panel after interfering with the millimeter wave radar is the same as that of the ultrasonic radar. The interference device can also be used to make the system make the wrong distance judgment. Regardless of the distance between the ultrasonic radar and the millimeter wave radar, from the actual driving scene, only a small distance error judgment will be more misleading, such as more interference when reversing or parking. It is for the Autopilot system.
If the sensor is seriously disturbed, under Autopilot, the system will also make a judgment that "the sensor is not working properly", so that Autopilot cannot be started and the manual state is required.
3. Camera
Although Tesla’s death accident in May has not yet been finalized, the “blindness†effect of the truck’s white container on the camera is the entry point for Liu Jian’s research. However, the interference to the camera is not directly carried out in the car, but the camera is removed.
Blind camera blinding camera is to use a direct light source camera (or direct calibration plate, let it reflect light toward the camera), the final effect depends on the distance between the light source and the camera, and the strength of the light source. According to Liu Jianwei, using 200 milliwatts of infrared light at a distance of 50cm from the camera can blind the camera for 40 seconds. If the distance increases, the effect will decrease. If the light source is too strong, it will cause the camera to burn directly.
As a result of the blinding of the camera, of course, the distance of 50 cm is not realizable in the real life of the vehicle, and as the distance is elongated, blinding can be caused by increasing the intensity of the light source. As long as the blindness is 2-3 seconds, it is likely to have serious consequences for the car with the automatic driving state.
In terms of hardware, the camera itself has a refresh rate. If the refresh rate is high enough, the blinding effect will be weakened.
Sensors can be deceived. What does this mean?
As you can see from the previous description, it is not an easy way to implement an attack from a sensor.
Among the three sensors mentioned, the easiest to achieve is ultrasound. The cost of the equipment is low, and it is easy to get started. A charging treasure can keep it working. Although there is a limitation of distance, in addition to the basement, it can also be realized by following the way. To blind the camera, on the one hand, the farther the distance is, the worse the effect is. Although blinding for even one second may cause serious consequences, it requires a careful planning, especially for millimeter-wave radar.
Diesel Pressure Sensor,Hydraulic Pressure Gauge,Rail Pressure Sensor,Absolute Pressure Transmitter
Shenzhen Ever-smart Sensor Technology Co., LTD , https://www.fluhandy.com