This WAV File Can Confuse Your Fitbit

As the devices with which we surround ourselves become ever more connected to the rest of the world, a lot more thought is being given to their security with respect to the internet. It’s important to remember though that this is not the only possible attack vector through which they could be compromised. All devices that incorporate sensors or indicators have the potential to be exploited in some way, whether that is as simple as sniffing the data stream expressed through a flashing LED, or a more complex attack.

Researchers at the University of Michigan and the University of South Carolina have demonstrated a successful attack against MEMS accelerometers such as you might find in a smartphone. They are using carefully crafted sound waves, and can replicate at will any output the device should be capable of returning.

MEMS accelerometers have a microscopic sprung weight with protruding plates that form part of a set of capacitors. The displacement of the weight due to acceleration is measured by looking at the difference between the capacitance on either side of the plates.

The team describe their work in the video we’ve put below the break, though frustratingly they don’t go into quite enough detail other than mentioning anti-aliasing. We suspect that they vibrate the weight such that it matches the sampling frequency of the sensor, and constantly registers a reading at a point on its travel they can dial in through the phase of their applied sound. They demonstrate interference with a model car controlled by a smartphone, and spurious steps added to a Fitbit. The whole thing is enough for the New York Times to worry about hacking a phone with sound waves, which is rather a predictable overreaction that is not shared by the researchers themselves.

Continue reading “This WAV File Can Confuse Your Fitbit”

Small And Inexpensive MEMS Gravimeter

A gravimeter, as the name suggests, measures gravity. These specialized accelerometers can find underground resources and measure volcanic activity. Unfortunately, traditional instruments are relatively large and expensive (nearly 20 pounds and $100,000). Of course, MEMS accelerometers are old hat, but none of them have been stable enough to be called gravimeters. Until now.

In a recent edition of Nature (pdf), researchers at the University of Glasgow have built a MEMS device that has the stability to work as a gravimeter. To demonstrate this, they used it to measure the tides over six days.

The device functions as a relative gravimeter. Essentially a tiny weight hangs from a tiny spring, and the device measures the pull of gravity on the spring. The design of the Glasgow device has a low resonate frequency (2.3 Hz).

Small and inexpensive devices could monitor volcanoes or fly on drones to find tunnels or buried oil and gas (a job currently done by low altitude aircraft). We’ve covered MEMS accelerometers before, although not at this stability level.  We’ve even seen an explanation from the Engineer Guy.

SensorTape Unrolls New Sensor Deployment Possibilities

An embedded MEMS sensor might be lots of fun to play with on your first foray into the embedded world–why not deploy a whole network of them? Alas, the problem with communicating with a series of identical sensors becomes increasingly complicated as we start needing to handle the details of signal integrity and the communication protocols to handle all that data. Fortunately, [Artem], [Hsin-Liu], and [Joseph] at MIT Media Labs have made sensor deployment as easy as unraveling a strip of tape from your toolkit. They’ve developed SensorTape, an unrollable, deployable network of interconnected IMU and proximity sensors packaged in a familiar form factor of a roll of masking tape.

Possibly the most interesting technical challenge in a string of connected sensor nodes is picking a protocol that will deliver appreciable data rates with low latency. For that task the folks at MIT Media labs picked a combination of I²C and peer-to-peer serial. I²C accomodates the majority of transmissions from master to tape-node slave, but addresses are assigned dynamically over serial via inter-microcontroller communication. The net effect is a fast transfer rate of 100 KHz via I²C with a protocol initialization sequence that accommodates chains of various lengths–up to 128 units long! The full details behind the protocol are in their paper [PDF].

With a system as reconfigurable as SensorTape, new possibilities unfold with a solid framework for deploying sensors and aggregating the data. Have a look at their video after the break to get a sense of some of the use-cases that they’ve uncovered. Beyond their discoveries, there are certainly plenty others. What happens when we spin them up in the dryer, lay them under our car or on the ceiling? These were questions we may never have dreamed up because the tools just didn’t exist! Our props are out to SensorTape for giving us a tool to explore a world of sensor arrays without having to trip over ourselves in the implementation details.

via [CreativeApplications]

Continue reading “SensorTape Unrolls New Sensor Deployment Possibilities”

Power from Paper

Comedian Steven Wright used to say (in his monotone way):

“We lived in a house that ran on static electricity. If we wanted to cook something, we had to take a sweater off real quick. If we wanted to run a blender, we had to rub balloons on our head.”

Turns out, all you need to generate a little electricity is some paper, Teflon tape and a pencil. A team from EPFL, working with researchers at the University of Tokyo, presented just such a device at a MEMS conference. (And check out their video, below the break.)

Continue reading “Power from Paper”

Tearing Down The Apple Watch

The Apple Watch has been out for nearly a month now, but so far we haven’t seen a good look at the guts of this little metal bauble of electronic jewelry. Lucky for us that a company in China is hard at work poking around inside the Apple Watch and putting up a few incredible SEM images along the way (Google Translatrix).

This isn’t the first Apple Watch teardown that’s hit the intertubes – iFixit tore one apart with spudgers and tiny screwdrivers and found someone skilled in the ways of tiny parts could probably replace the battery in this watch. Shocking for an Apple product, really. iFixit also took a look at the watch with an x-ray, revealing a little bit of the high-level design of the Apple Watch, the Apple S1 computer on a chip, and how all the sensors inside this wearable work.

A side view of a 6-DOF IMU
A side view of a 6-DOF IMU

This teardown uses an incredible amount of very high-tech equipment to peer inside the Apple Watch. Because of this, it’s probably one of the best examples of showing how these tiny sensors actually work. With some very cool images, a 6-DOF IMU is revealed and the Knowles MEMS microphone is shown to be a relatively simple, if very small part.

Now the Apple S1, the tiny 26.15mm x 28.50mm computer on a chip, serves as the brains of the Apple Watch. It’s breathtakingly thin, only 1.16mm, but still handles all the processing in the device.

Even if you won’t be buying this electronic accessory, you’ve got to respect the amazing amount of engineering that went into this tiny metal bauble of semiconductors and sensors.

Accelerometers Are Actually Quite Simple

An accelerometer is the ubiquitous little sensor that tells your tablet when to flip orientation or informs the brain of your quadcopter how closely its actual actions are matching your desired ones. In a quick three minutes, [Afroman] explains what is inside an accelerometer and how they work.

It turns out the tiny devices that report acceleration in one, two or three dimensions are not powered by magic complicated mechanisms but very simple Micro Electro-Mechanical Systems or “MEMS.” MEMS are similar to copper/silver/gold-wired integrated circuits except in a MEMS circuit conductive silicon is used and they actually physically move, but only just a bit.

The secret is in creating microscopic capacitors along a weighted lever that flexes in response to changes in velocity. When the plates flex the distance between them changes which alters the capacitance. This translates physical motion into voltage which can then be interpreted by the rest of your circuit. The chemistry behind MEMS is interesting too.

This Christmas when your laptop’s power cord clotheslines your cousin’s kid, your hard drive has a chance of parking the head (on the drive, not on the child) between fall and impact and preventing damage (to the drive, not to the child) because of an accelerometer. If bad roads cause you to drift into the ditch, it is an accelerometer that senses the crash and tells your airbag to deploy before your body hits the steering wheel.

The MEMS market is exploding right now and for us hackers in particular, Wearables are looking to be a big part of that growth.

Phone Gyroscope Signals Can Eavesdrop on Your Conversations

A gyroscope is a device made for measuring orientation and can typically be found in modern smartphones or tablet PCs to enable rich user experience. A team from Stanford managed to recognize simple words from only analyzing gyroscope signals (PDF warning). The complex inner workings of MEMS based gyroscopes (which use the Coriolis effect) and Android software limitations only allowed the team to only sniff frequencies under 200Hz. This may therefore explain the average 12% word recognition rate that was achieved with custom recognition algorithms. It may however still be enough to make you reconsider installing an app that don’t necessarily need access to the on-board sensors to work. Interestingly, the paper also states that STMicroelectronics currently have a 80% market share for smartphone / Tablet PCs gyroscopes.

On the same topic, you may be interested to check out a gyroscope-based smartphone keylogging attack we featured a couple of years ago.