In the open hardware world, we like to share 3D design files so that our friends and (global) neighbors can use and improve them. But we’ve all printed things from time to time that we’d like to keep secret. At least this is the premise behind this article in Science which proposes a novel method of 3D-printer-based industrial espionage: by recording the sound of the stepper motors and re-creating the toolpath.
Unfortunately, the article is behind a paywall so we’re short on the details, but everyone who’s played the Imperial March on their steppers has probably got the basic outline in their mind. Detecting the audio peak corresponding to a step pulse should be fairly easy. Disentangling the motions of two axes would be a bit harder, but presumably can be done based on different room-acoustic filtering of the two motors. Direction is the biggest question mark for us, but a stepper probably has a slightly audible glitch when reversing. Keeping track of these reversals could do the trick.
What do you think? Anyone know how they did it? Does someone with access to the full article want to write us up a summary in the comments?
[Thanks LVfire via Ars Technica]
[Edit: We were sent a copy of the full article (thanks [PersonUnknown]!) and it doesn’t explain any technical details at all. Save yourself the effort, and have fun speculating, because reading the article won’t help.]
So, to theft-proof your 3D printed designs, just add a speaker playing the soundtrack from a mario game while you print…
White Noise would be better, otherwise you could filter out the Mario because it has a known pattern.
Another aspect is dithering the path with a random sequence which you save, allows you pinpoint when someone took the recording. It would require fine Z/Y/X resolution tho.
How about playing the sound of stepper motors printing out a large phallus ?
+1
great, now people will not know when im printing an anal toy.
Damn it… how did you know..!!
How about something like “Eye of the Tiger” played on a dot matrix printer?
https://www.youtube.com/watch?v=u8I6qt_Z0Cg
I see 3D watermarking plugins being the next logical step.
Obfuscation would be ridiculously easy if this sidechannel was ever actually a concern.
Throw in a few extra stepper motors with dummy loads and have it run at random direction and intervals.
Or play something by Justin Bieber. Those spies would commit suicide rather than try to discern the specific printer sound through the music.
this
Or just don’t use steppers like on the New Matter MOD-t :)
This is so last century… in the 1980’s, industrial spies were using “laser mics” that could pick up sound from vibrating window glass and there was another trick to “see” what was on a PC monitor by picking up subtle changes in the electro-magnetic field. Some things never change
I remember seeing the video where the highspeed camera was used to detect vibrations on the object.(I think it was a houseplant). I believe it was featured on Hackaday few years ago.
That’d need high speed, high-resolution, and good magnification. Far as I know they’re all exclusive to each other, the more of one, the less of the others. Must’ve been a hell of a camera.
Not really. Its a pretty cool trick. See here: http://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804
http://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804
I always thought it should be possible to create a laser mic using a telescope focused on the dot of the laser. The image focuses down to such a fine point that the light output should be sufficient to drive an opamp and create noise. Currently they rely on the direct reflection which requires being at a very direct position. The way I am proposing would make no difference as to which direction you face as long as the bounced laser light makes it back through the telescope optics from whatever angle it is received in. Never tried to build it but it should work in theory.
In the early nineties it was claimed that each key on a keyboard made its’ own unique sound because of its placement and listening to someone typing on one over a telephone could reveal passwords.
These quotes sum up the specifics. If you want any other information from the article I can look later.
“A simple audio recording—possibly even one made by a smartphone—can be enough to reverse-engineer a 3D-printed object, a new paper shows. From the sounds the device emits while printing, an attacker can recreate the source code that contains the shape of the 3D-printed object.”
“Using a Printrbot 3D printer, the researchers printed several sizes and shapes of objects … while recording the hums and beeps made by the machine. Then they tested how well the source code for each could be reconstructed from recordings. Borrowing methods from speech pattern recognition, they found that a computer could “learn” an object’s code with an average accuracy of 78%. The accuracy with a key, the most complex shape tested, was 92%.(The square and triangle were smaller, which made their designs harder to recreate.) “
I think the Printrbot is key here. As it uses different mechanics for X, Y and Z. Most likely having different mechanical frequencies. If your X and Y are very similar like the Ultimaker setup, you will most likely have a much harder time.
Article says nothing about using dual mics, says kid was 30cm away from the printer, said avg accuracy was 78%, with Max accuracy of 92%. No real details of algorithm.
By kid I meant mic (auto-correct)
So auto-correct literally did a mic drop…
Too good!
Sounds like what researchers did a couple years back with listening to a hard drive to break encryption here.
If you can get a microphone 30cm from the printer, You can get a camera to record the whole printing process surely that would bea better medium to steal the print? just make sure camera is steady use OCR software to log the stepper position and the axis lengths and bingo write a program to recreate the whole print routine. I bet it would be more accurate howeer doing it by sound makes it seem cooler.
Not necessarily. A camera needs to have a good view of the printer, which makes it harder to “install”. An audio recorder you could just drop somewhere close when walking by (if you’re skilled, you could even do this when someone watching you). You could also hide to microphone under something (like place it under the printer). No one will ever think to look under the printer. Hiding a camera takes much more skills and time.
I agree a microphone would be easier to install but camera’s are tiny these days I don’t think you would have too much difficulty in hiding one close by with a good view.
Simple way to defeat it, just use a delta or corexy, while the corexy would allow you to sense Z, neither has a difference in motor sound for X and Y axis.
I also wonder if they took into account the slicing software or just relied one. Cura and Slic3r can produce quite different toolpaths.
OR you could just download your own copy of the gcode from thingiverse.
They don’t host gcode.
I worked in a field whose main purpose was the separation and analysis of audio signals. These signals would come from 10+ sources spread far apart. Let me just say up front: Two stepper motors sound nothing alike. With the right knowledge and software/hardware combination, you can pick the sound of a piece of sand grinding the inside of a bearing over the noise of a compressor.
Without gathering detailed data about the exact machine you’re targeting, copying the designs 100% would be near impossible. You can get extremely close, but you need calibrated sound data vs. mechanical information end-to-end to get a perfect match.
I think you’re right. But we know all sorts of things about the way the printer works that you can maybe use to calibrate it. For instance, if the homing step before printing always goes y-x-z (as mine does) then you have a sample of each motor moving independently to train on.
Anyway, I think this is cooler as a demo than as an actual bit of spycraft. Assuming a properly located microphone in the same room as the printer, why not just take a photo as many have pointed out.
See my above comment. If you are a spy (and I’m not saying this is a viable spying method) you might gain access to the machine while it’s not printing anything important (secret). Installing a camera is much harder than installing a microphone.
I’m reminded of the old science fiction story Farewell to the Master by Harry Bates
https://en.wikipedia.org/wiki/Farewell_to_the_Master
Hmm. I wonder if you could construct gcode for a printer such that it both plays a recognisable stepper music (as opposed to just generic stepper noise) AND the playing of that stepper music resulted in a recognisable object (as opposed to a mess of plastic filament)
You can change pitch by changing speed. Arranging speeds as 20-40-80 mm/s the printer will shift octaves when doing different parts. This also makes the noise more bearable and musical.
After playing music for several years i’ve arranged the slicer setting so they never produce off key sounds.
That is why the NSA uses Trinamic drivers with StealthChop to protect their 3D prints!
Or just, you know, beat up the nerd printing and steal their whole printer.
sci-hub.io has an access to the article …
For everyone without access to the file because of the paywall:
https://filetea.me/t1sOO6AZWWmTtSI1JYQOM62KA
In case link does not work:
https://gofile.io/?id=CroXPc
can someone buy the article and post it on tpb or something?
see post above.
This shouldn’t be too hard given a few things we know:
1 – The stepper motors have different placement around the printer and they are driven by constant current, so a single microphone would likely see 4 different constant-amplitude sources.
2 – The mechanics of 3d printers requires that there be no instantaneous velocity change, so plotting the frequencies will always yield continuous curves.
3 – Axis can only reverse when the stepper motor velocity reaches 0, so the frequency of the motor will also touch 0. Because most prints create the shell before the infill, and the shell is usually a continuous curve, only one motor is likely to cross 0 velocity at a time, and will usually be changing direction when it does. The infill will present a problem, but can be ignored.
4 – Only 3 motors are running at a time in a x-y-z or corexy configuration, but 4 motors in a delta. The extruder motor will be easy to pick out because it will be very consistent. Separating 2 or 3 frequencies is very easy.
5 – Every layer will have a clean break where the z-level changes, so it will be easy to compare layer to layer for error correction.
Process:
Record sound > Convert to frequency domain > separate each continuous frequency > search and remove infill portions > Integrate to get positions > graph results.
The real results are in his scientific paper:
Warning PDF file
http://aicps.eng.uci.edu/papers/NDSS_Poster_Abstract.pdf