Temperature sensors can be remotely targeted and hacked

Critical processes from maintaining incubator temperatures to safeguarding chemical reactions in industry rely on real-time monitoring and control from temperature sensors to stay safe and accurate. The ubiquitous devices ensure that these systems make proper adjustments to their sensitive environments, keeping infants healthy and industrial processes safe for the surrounding area.

A research team led by Prof. Kevin Fu at the University of Michigan and Prof. Xiali Hei lab from the University of Louisiana at Lafayette has demonstrated that these temperature control systems, particularly in sensitive devices like infant incubators or industrial thermal chambers, can be remotely manipulated using electromagnetic waves.

The vulnerability is a result of the weakness of analog sensing components. The attack exploits an unintended rectification effect in amplifiers, and can be induced by injecting electromagnetic interference at a certain wavelength through the temperature sensors. The researchers, led by Sara Rampazzi from the University of Michigan and Yazhou Tu from the University of Louisiana at Lafayette, demonstrated an adversary could remotely manipulate the temperature sensor measurements without tampering with the targeted system or triggering automatic temperature alarms. For instance, from meters away, or even in an adjacent room, an attacker could trick the internal control system of an infant incubator to heat up or cool down the cabin to unsafe temperatures.

“These dangerous temperatures can raise the risk of temperature-related health issues in infants, such as hyperthermia and hypothermia, which in turn can lead in extreme cases to hypoxia, and neurological complications,” Rampazzi said.

Several different types of analog temperature sensors such as thermocouples, NTC thermistors, and resistance temperature detectors (RTDs) are susceptible to adversarial control.

“The exploit of this hardware-level vulnerability could affect different classes of analog sensors that share similar signal conditioning processes, for example pressure or pH sensors,” Rampazzi said.

The authors described how to defend against the attack, proposing a prototype of an analog anomaly detector that can identify malicious interference in the vulnerable frequency range.

“Once the interference is detected, the signal information can be used by the system software to estimate the sensor data reliability.” Tu said.

University of Michigan

University of Michigan

– Edited by Chris Vavra, production editor, Control Engineering, CFE Media & Technology, cvavra@cfemedia.com. See more Control Engineering process sensor and actuator stories.