A very interesting paper entitled Rocking Drones with Intentional Sound Noise of Gyroscopic Sensors. A MultiWii and APM drone were tested. One went down (see below for answer as to which):
Abstract
Sensing and actuation systems contain sensors to observe the environment and actuators to influence it. However, these sensors can be tricked by maliciously fabricated physical properties. In this paper, we investigated whether an adversary could incapacitate drones equipped with Micro-Electro-Mechanical Systems (MEMS) gyroscopes using intentional sound noise. While MEMS gyroscopes are known to have resonant frequencies that degrade their accuracy, it is not known whether this property can be exploited maliciously to disrupt the operation of drones. We first tested 15 kinds of MEMS gyroscopes against sound noise and discovered the resonant frequencies of seven MEMS gyroscopes by scanning the frequencies under 30 kHz using a consumer-grade speaker. The standard deviation of the resonant output from those gyroscopes was dozens of times larger than that of the normal output. After analyzing a target drone’s flight control system, we performed real-world experiments and a software simulation to verify the effect of the crafted gyroscope output. Our real-world experiments showed that in all 20 trials, one of two target drones equipped with vulnerable gyroscopes lost control and crashed shortly after we started our attack. A few interesting applications and countermeasures are discussed at the conclusion of this paper.
Answer:
Comments
@Ben didnt the Iranians down the RQ-170 Sentinel drone kinda how you described?
Anything that has a sensor, that takes communications links – as does the RQ-170, which has two, one for the satellite, and the other is line-of-sight with the ground control station – all it takes is disrupting that.
http://www.csmonitor.com/World/Middle-East/2011/1209/Downed-US-dron...
incredible times we live in.
Well, a solution to bring the drone to a specified location already exists and is currently in use : they create a false GPS (or GLONASS etc) signal that will progressively bring the drone to the desired location while it thinks it continues to follow its normal path. Given that the GPS signals are extremely weak it's easy to overpower them even at large distances.
Even for researchers, generating a GPS signal is not too complex, all satellites are transmitting on the same frequency (or two frequencies ?), and the protocol is well known.
This type of attack is however detectable.
The biggest challenge remains untamed. It isn't how to take it down. It's how to not take it down. Dropping out of the sky onto whatever happens to be below it is not a solution that anyone likes. Whatever harmful payload it's carrying will fall on whatever happens to be below it. That could easily cause way more harm than if it reached it's intended target. What everyone really wants is to be able to takeover control and send it to a safe location of their choice. This is exponentially more complicated than simply swatting it out of the sky.
This work was not intended to down drones. Only test the MEMS gyro vulnerablity through resonance. Only the reason for selected such that it very stupid method of demonstration was idiotical antidrone company. In this way, the authors sought to draw more attention to their work. In fact there is much more actual problem with vibrations of industrial manipulators, UGV, and same type automatas..
There's another point which is not mentionned in the article, the Doppler effect : if the source is moving relatively to the target, the perceived frequency will be higher (or lower).
The effect is not neglectable, if the drone is moving relatively to the source at 2 m/s, the frequency will be 20116Hz (if the source was 20000Hz). If it's moving at 10 m/s, the frequency will become 20583Hz.
The article doesn't mention how precise the frequency has to be, but probably a difference of a few hundreds Hz will get it out of resonnance.
To me it still looks difficult to exploit in practice :
- heavy equipment to achieve only 100 meter range (even if the precise equipment sizing is not clear)
- requires continuous aiming (even during the target fall)
- dangerous sound level for operator (and animals who can hear ultrasounds)
- not all gyroscopes are vulnerable
- different frequencies for different gyro models
- not all axis have the same resonnant frequency
- the article mention foam isolation as an effective protection
- probably less efficient if the target is moving (doppler effect)
- probably the software can be evolved to detect such attack and rely on other sensors at least not to crash
This work was supported by Samsung Research Funding Center of
Samsung Electronics under Project Number SRFC-TB1403-01.
https://www.usenix.org/system/files/conference/usenixsecurity15/sec...
Much more interesting research
https://books.google.ru/books?id=FCBlJjPzba4C&pg=PA283&lpg=...
more than 95db - they just themselves deaf =)
Ben - The SB-3F is "comprised of 448 one-inch neodymium transducers - each a powerful point source with a wide dynamic range" powered by a "9000W" (Peak, not RMS) amplifier and delivering a "10-degree" sound dispersion. This is very similar to what I described above with a few major differences.
The image below shows 12 of these SB-3Fs assembled to form a larger line array creating a vertical dispersion pattern - which I don't quite understand (I would expect them to be arranged vertically so to provide a horizontal dispersion pattern like this).
The wide dynamic range of 2-9kHz offered by the SB-3Fs is necessary for music and voice reproduction but not required if simply generating a sinewave at one specific freqency. Also, the vast majority of the power delivered by the amplifier in the SB-3Fs would be used towards the lower end of the frequency response.
Dedicated to only one frequency compression drivers are able to be tuned to that specific frequency. Generating a simple sinewave at a relatively high frequency of 8.2kHz, the amplifier need not be so big either.
The French are noted for and I believe the US military has experimented with phased array focused infrasonic sound projectors.
They do take a lot of energy to operate and they are large, but you could probably come up with a directable one that you could use to protect specific facilities and they would probably induce sufficient vibration to seriously confuse most drones.
I don't think even optical flow would be immune because the image would be bouncing all over the place.
That said the high intensity sound may be a lot worse danger than the "drone".
Best,
Gary
The article says that the device they could use for 100 meter range is this one :
http://www.meyersound.com/product/sb-3f/
Have a look a the photo, it's *really* huge.
It looks non portable, and this is a directionnal source. If the drone is moving, which it likely is, such a large device is unpractical, and requires some kind of aiming (even if done electronically by chaning the phase of the sound sources)
With their experimental setup (loudspeaker), they mention sub meter distance at maximum volume.
I wonder if something can be done by software : it looks like the attack is clearly visible as the "noise" on the gyros is visible, could the APM/Pixhawk enter a special mode where it would not use the gyros axis that are jammed ? (because it seems that not all axis are resonnant at the same frequency)
Also we can assume that the attacker will have to try different frequencies if he doesn't know the exact model of gyro used.
And let's say only use the accelerometer, I know it's very difficult (or impossible) for a quad to be stabilized only with an accelerometer, but for a plane it should be possible ?
I remember the Dragon OSD / autopilot that had no gyroscopes and only accelerometers, it was still OK for planes : it was programmed for very slow movements, so that the acceleration during turns was small in comparison to gravity.
-
1
-
2
of 2 Next