Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors

TLDR

Electromagnetic interference induces voltages on conductors, and analog sensors measuring millivolt signals are especially vulnerable. The study measures analog sensor susceptibility to intentional low‑power EMI signal‑injection attacks and proposes defenses to mitigate the risks. The authors evaluate sensor vulnerability by exposing implantable medical devices and consumer electronics to tailored EMI at different powers and distances, and they propose a suite of defenses—including analog shielding, a root‑mean‑square contamination metric, and a pacing‑pulse consistency check—to detect or prevent forged signals. The experiments reveal that consumer electronics with microphones can be compromised by bogus audio signals at 1–2 m, while free‑air EMI below 10 W can disrupt pacing and trigger defibrillation shocks on implantable cardiac devices up to 1–2 m, but the effective range drops to roughly 5 cm when the devices are immersed in saline to mimic the human body.

Abstract

Electromagnetic interference (EMI) affects circuits by inducing voltages on conductors. Analog sensing of signals on the order of a few millivolts is particularly sensitive to interference. This work (1) measures the susceptibility of analog sensor systems to signal injection attacks by intentional, low-power emission of chosen electromagnetic waveforms, and (2) proposes defense mechanisms to reduce the risks. Our experiments use specially crafted EMI at varying power and distance to measure susceptibility of sensors in implantable medical devices and consumer electronics. Results show that at distances of 1-2m, consumer electronic devices containing microphones are vulnerable to the injection of bogus audio signals. Our measurements show that in free air, intentional EMI under 10 W can inhibit pacing and induce defibrillation shocks at distances up to 1-2m on implantable cardiac electronic devices. However, with the sensing leads and medical devices immersed in a saline bath to better approximate the human body, the same experiment decreases to about 5 cm. Our defenses range from prevention with simple analog shielding to detection with a signal contamination metric based on the root mean square of waveform amplitudes. Our contribution to securing cardiac devices includes a novel defense mechanism that probes for forged pacing pulses inconsistent with the refractory period of cardiac tissue.