There’s something spooky going on. New research from the Ubiquitous System Security Lab, Zhejiang University Security and Privacy Research Group and the University of Michigan found ‘poltergeist’ (PG) attacks can fool autonomous vehicles in a way that hasn’t been seen before. Take a look at what the researchers found about how this attack works.

Vehicles with a self-driving feature rely on computer-enabled, object-based detection. This classifies objects, deciding what is an obstacle and what is a normal road condition. Using those decisions, autonomous vehicles make moves on their own. Poltergeist attackers tamper with those classification results.

Bombarding Self-Driving Cars With Acoustic Signals

To be specific, the poltergeist attack affects the stabilization of images detected by a vehicle. In their paper, the researchers noted this isn’t the same as past studies in which people showed the security risks of self-driving cars by targeting the main image sensors, such as the complementary metal-oxide semiconductor. Instead, they singled out inertial sensors. These provide an image stabilizer with motion feedback that it can use to reduce blur.

The researchers designed their PG attack to target those initial sensors with resonant acoustic signals. In doing so, they found that someone could gain control of the stabilizer. From there, the attacker could then perform one of the following three types of attacks:

  • Hiding Attacks: A threat actor could make a detected object, such as the rear of a car, disappear.
  • Creating Attacks: Someone could fool the computer detection systems into detecting an object that isn’t really there.
  • Altering Attacks: An attacker could cause the computer detection systems to classify one object as another.

In testing those attacks, the researchers saw a 100% success rate with people, cars, trucks, buses, traffic lights and stop signs with hiding attacks. The other two attack scenarios varied in success depending on which objects were involved and the extent to which they were targeted.

Researchers Leading Vehicle Hacking

Fooling object detection systems is just one of the types of attacks threat actors could use to prey upon self-driving vehicles. Others include using beams of light and adversarial machine learning to tamper with the vehicles’ decisions and/or performance.

Back in 2018, for instance, a hacker found that a threat actor could embed a custom piece of hardware into a self-driving vehicle. Then, they could use it to control almost any component of the car, including the brakes and speed.

In February 2020, another group of hackers made one type of autonomous vehicle speed up to 85 mph in a 35 mph zone.

Toward Better Cybersecurity in Autonomous Vehicles

The researchers working on the PG problem also offered some solutions. Vehicle makers who include a self-driving feature should include safeguards, such as using a microphone to detect acoustic injection attacks. They can also add adversarial training into their object detection algorithms.

In addition, autonomous vehicle manufacturers should ensure that third-party providers and others along their supply chains follow security best practices. This could keep malicious actors out of the supplier’s network, removing the chance for follow-up attacks.

Self-driving cars may seem like a sign of the future, but keeping threat actors from taking control of them is a problem researchers have been working on for years. This new type of attack is just one example of that.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…