Skip to main content
Springer Nature Link
Log in

EARIC: Exploiting ADC Registers in IoT and Control Systems

  • Conference paper
  • First Online:
Applied Cryptography and Network Security Workshops (ACNS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13907))

Included in the following conference series:

Abstract

An analog-to-digital converter (ADC) is a critical part of most computing systems as it converts analog signals into quantifiable digital values. Since most digital devices operate only on digital values, the ADC acts as an interface between the digital and analog worlds. Hence, ADCs are commonly used in a wide-range of application areas, such as internet of things (IoT), industrial control systems (ICS), cyber-physical systems (CPS), audio/video devices, medical imaging, digital oscilloscopes, and cell phones, among others. For example, programmable logic controllers (PLCs) in ICS/CPS often make control decisions based on digital values that are converted from analog signals by ADCs. Due to its crucial role in various applications, ADCs are often targeted by a wide-range of physical and cyber attacks. Attackers may exploit vulnerabilities that could be found in the software/hardware of ADCs. In this work, we first conduct a deeper study on the ADC conversion logic to scrutinize relevant vulnerabilities that were not well explored by prior works. Hence, we manage to identify exploitable vulnerabilities on certain ADC registers that are used in the ADC conversion process. These vulnerabilities can allow attackers to launch dangerous attacks that can disrupt the behaviour of the targeted system (e.g., an IoT or control system) in a stealthy way. As a proof of concept, we design three such attacks by exploiting the vulnerabilities identified. Finally, we test the attacks on a mini-CPS testbed we designed using IoT devices, analog sensors and actuators. Our experimental results reveal high effectiveness of the proposed attack techniques in misleading PLCs to make incorrect control decisions in CPS. We also analyze the impact of such attacks when launched in realistic CPS testbeds.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    https://www.arrow.com/en/research-and-events/articles/engineering-basics-what-is-a-microcontroller.

  2. 2.

    https://www.tutorialspoint.com/digital_communication/digital_communication_pulse_code_modulation.htm.

  3. 3.

    https://www.microchip.com/en-us/products/microcontrollers-and-microprocessors/32-bit-mcus/pic32-32-bit-mcus.

  4. 4.

    https://www.microchip.com/en-us/product/PIC32MX460F512L.

  5. 5.

    https://github.com/loathingKernel/ariadne-bootloader.

  6. 6.

    https://store.arduino.cc/products/arduino-mega-2560-rev3.

  7. 7.

    https://www.electronicwings.com/sensors-modules/lm35-temperature-sensor.

  8. 8.

    https://circuit.rocks/mini-metal-speaker-w-wires-8-ohm-0-5w.html.

References

  1. adafruit.com/: Using a temp sensor (2022). https://learn.adafruit.com/tmp36-temperature-sensor/using-a-temp-sensor

  2. Alphonsus, E.R., Abdullah, M.O.: A review on the applications of programmable logic controllers (plcs). Renew. Sustain. Energy Rev. 60 (2016)

    Google Scholar 

  3. analog.com: Ad9364 register map reference manual (2021). https://www.analog.com/media/cn/technical-documentation/user-guides/ad9364_register_map_reference_manual_ug-672.pdf

  4. Ashok, M., Levine, E.V., Chandrakasan, A.P.: Randomized switching SAR (RS-SAR) ADC protections for power and electromagnetic side channel security. In: 2022 IEEE Custom Integrated Circuits Conference (CICC), pp. 1–2 (2022)

    Google Scholar 

  5. Bolshev, A., Larsen, J., Krotofil, M., Wightman, R.: A rising tide: design exploits in industrial control systems. In: 10th USENIX Workshop on Offensive Technologies (WOOT 16). USENIX Association, Austin, TX (2016)

    Google Scholar 

  6. Chekole, E.G., Castellanos, J.H., Ochoa, M., Yau, D.K.Y.: Enforcing memory safety in cyber-physical systems. In: Katsikas S. et al. (eds.) Computer Security. SECPRE 2017, CyberICPS 2017 (2017)

    Google Scholar 

  7. Chekole, E.G., Chattopadhyay, S., Ochoa, M., Huaqun, G.: Enforcing full-stack memory safety in cyber-physical systems. In: Proceedings of the International Symposium on Engineering Secure Software and Systems (ESSoS 2018) (2018)

    Google Scholar 

  8. Chekole, E.G., Chattopadhyay, S., Ochoa, M., Guo, H., Cheramangalath, U.: CIMA: compiler-enforced resilience against memory safety attacks in cyber-physical systems. Comput. Secur. 94, 101832 (2020)

    Article  Google Scholar 

  9. Chekole, E.G., Huaqun, G.: ICS-SEA: formally modeling the conflicting design constraints in ICS. In: Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop, pp. 60–69. ICSS, Association for Computing Machinery, New York, NY, USA (2019). https://doi.org/10.1145/3372318.3372325

  10. Chekole, E.G., Ochoa, M., Chattopadhyay, S.: SCOPE: secure compiling of PLCs in cyber-physical systems. Int. J. Crit. Infrastruct. Prot. 33, 100431 (2021). https://doi.org/10.1016/j.ijcip.2021.100431

    Article  Google Scholar 

  11. Chen, R., Wang, H., Chandrakasan, A., Lee, H.S.: RaM-SAR: a low energy and area overhead, 11.3fj/conv.-step 12b 25ms/s secure random-mapping SAR ADC with power and EM side-channel attack resilience. In: 2022 IEEE Symposium on VLSI Technology and Circuits (VLSI Technology and Circuits), pp. 94–95 (2022)

    Google Scholar 

  12. Elshamy, M., Di Natale, G., Pavlidis, A., Louërat, M.M., Stratigopoulos, H.G.: Hardware trojan attacks in analog/mixed-signal ICS via the test access mechanism. In: 2020 IEEE European Test Symposium (ETS), pp. 1–6 (2020)

    Google Scholar 

  13. Gattu, N., Imtiaz Khan, M.N., De, A., Ghosh, S.: Power side channel attack analysis and detection. In: 2020 IEEE/ACM International Conference on Computer Aided Design (ICCAD), pp. 1–7 (2020)

    Google Scholar 

  14. Geng, Y., et al.: Defending cyber-physical systems through reverse engineering based memory sanity check. IEEE Internet Things J., 1–1 (2022)

    Google Scholar 

  15. Grami, A.: Chapter 5 - analog-to-digital conversion. In: Grami, A. (ed.) Introduction to Digital Communications, pp. 217–264. Academic Press, Boston (2016)

    Chapter  Google Scholar 

  16. Jeong, T.: Secure analog-to-digital conversion against power side-channel attack (2020). https://dspace.mit.edu/handle/1721.1/127018

  17. Jeong, T., Chandrakasan, A.P., Lee, H.S.: S2adc: A 12-bit, 1.25ms/s secure SAR ADC with power side-channel attack resistance. In: 2020 IEEE Custom Integrated Circuits Conference (CICC), pp. 1–4 (2020)

    Google Scholar 

  18. Jogdand, R.R., Dakhole, P.K., Palsodkar, P.: Low power flash ADC using multiplexer based encoder. In: 2017 International Conference on Innovations in Information, Embedded and Communication Systems (ICIIECS), pp. 1–5 (2017)

    Google Scholar 

  19. Kovacs, E.: ADC attacks can cause damage in industrial environments (2016). https://www.securityweek.com/adc-attacks-can-cause-damage-industrial-environments

  20. Kovacs, E.: PLCs vulnerable to stealthy pin control attacks (2016). https://www.securityweek.com/plcs-vulnerable-stealthy-pin-control-attacks

  21. Lab, M.: Analog to digital converter - how ADC works and types? (2017). https://microcontrollerslab.com/analog-to-digital-adc-converter-working/

  22. Langmann, R., Stiller, M.: The PLC as a smart service in industry 4.0 production systems. Appl. Sci. 9(18), 3815 (2019)

    Google Scholar 

  23. Le, B., Rondeau, T., Reed, J., Bostian, C.: Analog-to-digital converters. IEEE Signal Process. Mag. 22(6), 69–77 (2005)

    Article  Google Scholar 

  24. Lee, E.A.: Cyber physical systems: design challenges. In: 2008 11th IEEE International Symposium on Object and Component-Oriented Real-Time Distributed Computing (ISORC), pp. 363–369 (2008). https://doi.org/10.1109/ISORC.2008.25

  25. Li, P., Yi, X., Liu, X., Zhao, D., Zhao, Y., Wang, Y.: All-optical analog comparator. Sci. Rep. 6 (2016). https://doi.org/10.1038/srep31903

  26. Miki, T., Miura, N., Sonoda, H., Mizuta, K., Nagata, M.: A random interrupt dithering SAR technique for secure ADC against reference-charge side-channel attack. IEEE Trans. Circ. Syst. II: Express Briefs 67(1), 14–18 (2020)

    Google Scholar 

  27. Miki, T., Nagata, M.: Countermeasures against physical security attacks on ICs utilizing on-chip wideband ADCs. Japan. J. Appl. Phys. 61(SC), SC0803 (2022)

    Google Scholar 

  28. Mitescu, M., Susnea, I.: Interfacing to analog signals. Microcontrollers Pract., 93–106 (2005)

    Google Scholar 

  29. Munny, R., Hu, J.: Power side-channel attack detection through battery impedance monitoring. In: 2021 IEEE International Symposium on Circuits and Systems (ISCAS), pp. 1–5 (2021). https://doi.org/10.1109/ISCAS51556.2021.9401542

  30. Mynbaev, D.K., Scheiner, L.L.: Analog signals and analog transmission, pp. 103–201 (2020). https://doi.org/10.1002/9781119521501.ch2

  31. docs.rs online.com: 8-channel, 12-bit, configurable ADC/DAC with on-chip reference, i2c interface (2014). https://docs.rs-online.com/1e6a/0900766b813daba4.pdf

  32. Prathiba, G., Santhi, M., Ahilan, A.: Design and implementation of reliable flash ADC for microwave applications. Microelectron. Reliab. 88, 91–97 (2018). 29th European Symposium on Reliability of Electron Devices, Failure Physics and Analysis (ESREF 2018)

    Google Scholar 

  33. Satoh, T., Takahashi, K., Matsui, H., Itoh, K., Konishi, T.: 10-GS/s 5-bit real-time optical quantization for photonic analog-to-digital conversion. IEEE Photonics Technol. Lett. 24(10), 830–832 (2012)

    Google Scholar 

  34. Stouffer, K., Falco, J., Scarfone, K., et al.: Guide to industrial control systems (ICS) security. NIST Spec. Publ. 800(82), 16–16 (2011)

    Google Scholar 

  35. Taheri, S., Lin, J., Yuan, J.S.: Security interrogation and defense for SAR analog to digital converter. Electronics 6(2), 48 (2017)

    Article  Google Scholar 

  36. Taheri, S., Yuan, J.S.: Mixed-signal hardware security: attacks and countermeasures for \(\delta \sum \) ADC. Electronics 6(3), 60 (2017)

    Article  Google Scholar 

  37. Wadatsumi, T., Miki, T., Nagata, M.: A dual-mode successive approximation register analog to digital converter to detect malicious off-chip power noise measurement attacks. Japan. J. Appl. Phys. 60(SB), SBBL03 (2021)

    Google Scholar 

  38. Yadav, G., Paul, K.: Architecture and security of scada systems: a review. Int. J. Crit. Infrastruct. Prot. 34, 100433 (2021)

    Article  Google Scholar 

  39. Zanero, S.: Cyber-physical systems. Computer 50(4), 14–16 (2017)

    Article  Google Scholar 

Download references

Acknowledgment

The work is partially supported by A*STAR under its RIE2020 Advanced Manufacturing and Engineering (AME) Industry Alignment Fund - Pre Positioning (IAF-PP) Award A19D6a0053. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of A*STAR.

Author information

Authors and Affiliations

  1. Singapore University of Technology and Design, Singapore, Singapore

    Eyasu Getahun Chekole, Rajaram Thulasiraman & Jianying Zhou

Authors
  1. Eyasu Getahun Chekole
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rajaram Thulasiraman
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jianying Zhou
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Eyasu Getahun Chekole .

Editor information

Editors and Affiliations

  1. Singapore University of Technology and Design, Singapore, Singapore

    Jianying Zhou

  2. Radboud University Nijmegen, Nijmegen, The Netherlands

    Lejla Batina

  3. Shandong University of Science and Technology, Qingdao, China

    Zengpeng Li

  4. University of Science and Technology of China, Hefei, China

    Jingqiang Lin

  5. University of Padua, Padua, Italy

    Eleonora Losiouk

  6. Concordia University, Montreal, QC, Canada

    Suryadipta Majumdar

  7. Illinois at Singapore Pte Ltd., Singapore, Singapore

    Daisuke Mashima

  8. Technical University Denmark, Kongens Lyngby, Denmark

    Weizhi Meng

  9. Radboud University Nijmegen, Nijmegen, The Netherlands

    Stjepan Picek

  10. Florida International University, Miami, FL, USA

    Mohammad Ashiqur Rahman

  11. Zhejiang Gongshang University, Hangzhou, China

    Jun Shao

  12. SECOM Co., Ltd., University of Tsukuba, Tokyo / Ibaraki, Japan

    Masaki Shimaoka

  13. Royal Holloway University of London, Egham, UK

    Ezekiel Soremekun

  14. University of Aizu, Aizuwakamatsu, Fukushima, Japan

    Chunhua Su

  15. Universiti Sains Malaysia, Gelugor, Malaysia

    Je Sen Teh

  16. University of Luxembourg, Esch-sur-Alzette, Luxembourg

    Aleksei Udovenko

  17. City University of Hong Kong, Hong Kong, Hong Kong

    Cong Wang

  18. Griffith University, Southport, QLD, Australia

    Leo Zhang

  19. Delft University of Technology, Delft, The Netherlands

    Yury Zhauniarovich

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Chekole, E.G., Thulasiraman, R., Zhou, J. (2023). EARIC: Exploiting ADC Registers in IoT and Control Systems. In: Zhou, J., et al. Applied Cryptography and Network Security Workshops. ACNS 2023. Lecture Notes in Computer Science, vol 13907. Springer, Cham. https://doi.org/10.1007/978-3-031-41181-6_14

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-41181-6_14

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-41180-9

  • Online ISBN: 978-3-031-41181-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics