A Wolf in Sheep's Clothing: Spreading Deadly Pathogens Under the Disguise of Popular Music
A Wolf in Sheep's Clothing: Spreading Deadly Pathogens Under the Disguise of Popular Music
复制标题
DOI：
10.1145/3548606.3560643
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Anomadarshi Barua;Yonatan Gizachew Achamyeleh;M. A. Faruque
中科院分区：
文献类型：
--
作者：
Anomadarshi Barua;Yonatan Gizachew Achamyeleh;M. A. Faruque
负压室(NPR)是Biolab或传染病控制医院的生物安全级别(BSL)的基本要求，以防止致命病原体从设施中泄漏。NPR内部相对于外部参考空间保持负压力，因此微生物被包含在NPR内部。目前，建筑管理系统(BMS)使用差压传感器(DPS)来控制和监测核电站的负压。通过对DPS的共振频率进行欺骗，实现了对NPR的非侵入性和隐蔽性攻击。我们的贡献是：(1)我们发现，NPR中使用的DPS通常具有在可听范围内的共振频率。(2)我们利用这一发现来设计恶意音乐来在DPSS中产生共鸣，导致DPS的正常压力读数超调。(3)我们展示了DPSS中的共振如何欺骗BMS，从而使NPR将其负压变为正压，从而导致NPR潜在的致命微生物泄漏。我们对来自5个不同厂家的8个DPS进行了实验，在考虑采样管长度的情况下评估了它们的谐振频率，并在6个DPS中发现了共振。当没有采样管时，我们可以从~7 cm的距离获得2.5pA的负压变化，对于1m的采样管长度，可以从~2.5 cm的距离获得负压的变化。我们还介绍了一种对负压进行对抗性控制的区间-时间变化法，并证明了锻造压力可以在12-33帕范围内变化。我们的攻击也能够同时攻击多个NP。此外，我们演示了我们对位于匿名生物研究机构中的真实世界NPR的攻击，该机构是FDA批准的，并遵循CDC的指导方针。我们还提供了防止攻击的对策。
A Negative Pressure Room (NPR) is an essential requirement by the Bio-Safety Levels (BSLs) in biolabs or infectious-control hospitals to prevent deadly pathogens from being leaked from the facility. An NPR maintains a negative pressure inside with respect to the outside reference space so that microbes are contained inside of an NPR. Nowadays, differential pressure sensors (DPSs) are utilized by the Building Management Systems (BMSs) to control and monitor the negative pressure in an NPR. This paper demonstrates a non-invasive and stealthy attack on NPRs by spoofing a DPS at its resonant frequency. Our contributions are: (1) We show that DPSs used in NPRs typically have resonant frequencies in the audible range. (2) We use this finding to design malicious music to create resonance in DPSs, resulting in an overshooting in the DPS's normal pressure readings. (3) We show how the resonance in DPSs can fool the BMSs so that the NPR turns its negative pressure to a positive one, causing a potential leak of deadly microbes from NPRs. We do experiments on 8 DPSs from 5 different manufacturers to evaluate their resonant frequencies considering the sampling tube length and find resonance in 6 DPSs. We can achieve a 2.5 Pa change in negative pressure from a ~7 cm distance when a sampling tube is not present and from a ~2.5 cm distance for a 1 m sampling tube length. We also introduce an interval-time variation approach for an adversarial control over the negative pressure and show that the forged pressure can be varied within 12 - 33 Pa. Our attack is also capable of attacking multiple NPRs simultaneously. Moreover, we demonstrate our attack at a real-world NPR located in an anonymous bioresearch facility, which is FDA approved and follows CDC guidelines. We also provide countermeasures to prevent the attack.