How do we reverse engineer the Cuban "sonic weapon" attack-IEEE Spectrum

2021-12-14 10:03:31 By : Ms. Lisa ouyang

The IEEE website places cookies on your device in order to provide you with the best user experience. By using our website, you agree to the placement of these cookies. To learn more, please read our privacy policy.

Throughout last year, dozens of American and Canadian diplomats and their families living in Cuba contracted a mysterious disease. Symptoms include dizziness, insomnia, headaches, and hearing loss; many afflicted people are in their homes or hotel rooms when they hear strong, high-pitched sounds shortly before illness. In February of this year, the neurologist who examined the diplomat concluded that the symptoms were consistent with a concussion, but there was no blunt trauma to the head. The suggested culprits include toxins, viruses and sonic weapons, but so far, no cause has been confirmed.

We found the last suggestion-sonic weapons-very interesting, because at about the same time as the story about Cuba’s health problems began to appear, our laboratories at the University of Michigan at Ann Arbor and Zhejiang University in China were busy writing about our views on the ultrasound network. The latest research on security. We want to know, will ultrasound be the culprit in Cuba?

On the surface, this seems impossible. On the one hand, ultrasonic frequencies—20 kHz or higher—are inaudible to humans, while the voices heard by diplomats are clearly audible. More importantly, these frequencies cannot be transmitted through the air well, and will not cause direct harm to people except in thin conditions. Acoustics experts dismissed the idea that ultrasound might be problematic.

Then, about six months ago, an editor from The Conversation sent us a link to an Associated Press video, which was reportedly recorded in Cuba during an attack.

The editor asked our response. In the video, you can hear the harsh metallic sound-this is not pleasant. Watching the AP video frame by frame, we immediately noticed some strangeness. In one sequence, someone plays a sound file from one smartphone, while another smartphone records and draws a spectrogram. So the data is already a bit suspicious, because every microphone and every speaker will introduce some distortion. In addition, what humans hear is not necessarily the same as what the microphone picks up. Cleverly crafted sounds can cause auditory illusions similar to optical illusions.

AP video also includes a spectrogram of the recording-this is basically a visual representation of the intensity of various tones arranged in frequency. On closer inspection, we noticed a spectral peak close to 7 kHz and a dozen other low-intensity tones, which form a regular pattern with peaks separated by approximately 180 Hz. What causes these ripples every 180 Hz? What mechanism can make the ultrasonic source produce audible sound?

As the problems began to increase, it still didn't make sense to us, which seemed to be an excellent reason to dig deeper.

We also feel obligated to investigate. Our own research tells us that ultrasound can endanger the safety of multiple sensors widely used in medical equipment, self-driving cars, and the Internet of Things. In the past ten years, the two of us (Fu Hexu) have been collaborating on embedded security research, with the goal of discovering physics-based engineering principles and practices to make automated computer systems safe through design. For example, Xu’s 2017 paper "DolphinAttack: Inaudible Voice Commands" describes how we use ultrasonic signals to inject inaudible voice commands into voice recognition systems, such as Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana, Alexa An Audi car with navigation system.

The mystery of the Cuban ultrasound is too close to our research to be ignored.

When conducting this survey, one thing we know is that acoustic interference can occur in places where you least expect it. A few years ago, Mr. Fu was annoyed by the harsh sound of the light bulb in his apartment. He took a spectrum measurement and noticed that the light bulb tends to scream when the air conditioner is turned on. He finally concluded that the compressor was pumping coolant through its pipes at the same resonance frequency as the filament in the bulb. Normally, this will not be a problem. But in this case, the coolant pipe passes through the ceiling and is mechanically coupled to the ceiling joist that supports the bulb. The administrator opened the ceiling and used a piece of tape to separate the joists from the pipes to suppress unwanted coupling. The sound stopped.

We also know that in most cases, ultrasound is not considered harmful to humans. If misused, ultrasonic transmitters in direct contact with the human body can heat tissues and damage organs. The Occupational Safety and Health Administration (OSHA) warns that audible subharmonics caused by strong air-borne ultrasonic tones can be harmful. Therefore, the U.S. standard on ultrasonic emission establishes a safety margin to address these sub-harmonics. At the same time, the Canadian government has ruled that airborne ultrasound with a sound pressure of 155 decibels or higher may directly harm humans-which is larger than a jet plane taking off at 25 meters. The ruling also stated that “it is reported that aerial ultrasound can cause some'subjective' effects, including fatigue, headache, nausea, tinnitus and neuromuscular coordination disorders.”

Of course, even at 155 dB, the ultrasonic tones are still inaudible. Unless they are not-I'll cover them in detail later.

In order to make the problem easier to deal with, we first assume that the source of audible sound in Cuba is indeed ultrasound. Reviewing the OSHA guidelines, Fu concluded that the sound comes from the audible sub-harmonics of inaudible ultrasound. Contrary to harmonics that are generated by integer multiples of the fundamental frequency of sound, subharmonics are generated by integer divisors (or divisors) of the fundamental frequency, such as 1/2 or 1/3. For example, the second harmonic of an ultrasonic 20 kHz tone is clearly audible 10 kHz. However, the sub-harmonics do not fully explain the AP video: in the video, the spectrogram shows tones evenly spaced every 180 Hz, and the sub-harmonics will appear in the decreasing part of the original frequency. Such plots will not have a constant 180 Hz interval.

Dr. Fu explained his theory to Chen Yan. Student in Xu Lab. Yan Huixin: This is not sub-harmonic-this is intermodulation distortion.

Intermodulation distortion (IMD) is a strange effect. When multiple tones of different frequencies propagate in the air, IMD will produce multiple by-products at other frequencies. In particular, second-order IMD by-products will appear at the difference or sum of the two tonal frequencies. Therefore, if you start with a 25 kHz signal and a 32 kHz signal, the result may be a 7 kHz tone or a 57 kHz tone. The frequency of these by-products can be significantly reduced while maintaining most of the intensity of the original tone.

IMD is well known by radio engineers, who think it is not suitable for radio communication. Sound does not have to travel through the air; any "non-linear medium" will do. If the change in the output signal is not proportional to the change in the input, the medium is considered to be non-linear. Acoustic equipment such as microphones and amplifiers may also exhibit nonlinearity. One way to test it is to send two pure tones to an amplifier or microphone and then measure the output. If there are extra tones in the output, you know that the device is non-linear.

Computer science researchers have explored the physical properties of IMD. In the DolphinAttack paper, we use ultrasonic signals to trick the voice recognition assistant of the smartphone. Due to the nonlinearity of smartphone microphones, ultrasonic waves produce by-products at audible frequencies inside the microphone circuit. Therefore, humans still cannot hear the IMD signal, but the smart phone can hear the sound. In a paper in early 2017, Nirupam Roy, Haitham Hassanieh, and Romit Roy Choudhury of the University of Illinois at Urbana-Champaign described their BackDoor system [PDF], used to interfere with spy microphones and live concerts using ultrasound and IMD Watermark music played on and otherwise will produce "shadow" sound.

Some composers and musicians also use IMD to create synthetic sounds, combined with audible tones to create other subconscious audible tones. For example, in their book "A Guide to Musicians’ Acoustics" published in 1987, Murray Campbell and Clive Dart pointed out that the final movement of Sibelius’s Symphony No. 1 in E minor contained the tones that caused the rumble of IMD. . The human ear processes sound in a non-linear manner, so it can be "deceived" into tones that are not produced by musical instruments, or tones in the music score; when the played tones are non-linear combinations, these subconscious tones will be produced in the inner ear.

Back to our pursuit: Knowing that intermodulation distortion between multiple ultrasonic signals can cause low-frequency by-products, we next set out to simulate this effect in the laboratory, aiming to replicate what we observed in AP news videos. We used two signals: a pure 25 kHz tone and a 32 kHz carrier tone, the amplitude of which is modulated by a 180 Hz tone. (Our technical report "About Cuba, Diplomats, Ultrasonics, and Intermodulation Distortion" [PDF] describes in more detail the mathematics of how we do this.) The result is clear: strong tone at 7 kHz, repeated ripple separation By 180 Hz.

Then we conducted field experiments. In the simulation, we used two ultrasonic speakers to transmit signals, one was a 180 Hz sine wave amplitude modulated on a 32 kHz carrier, and the second was a single tone 25 kHz sine wave. We recorded the results with a smartphone. The IMD caused by the air and the smartphone microphone produces a 7 kHz signal. This video shows the experimental setup:

If you look closely at the spectrogram displayed on your smartphone, you will notice some high-end IMD by-products with frequencies of 4 kHz and above, as well as several other frequencies. Interestingly, although we could hear the 7 kHz tone during the experiment, we could not hear the 4 kHz tone recorded by the smartphone. We suspect that the 4 kHz tone is partly caused by the auxiliary IMD in the microphone itself. In other words, the microphone hears acoustic illusions that we cannot hear.

For fun, we also tried to use ultrasound carriers to eavesdrop on the room. In this setup, the spy places a microphone to pick up the voice, and then uses a relatively low-frequency audio signal to modulate the amplitude of the carrier. Then, the carrier is picked up by a sensor with ultrasonic function located at a certain distance and demodulated to restore the original audio. In our experiment, we chose a song to replace the audio signal recorded by the eavesdropping microphone: Rick Astley's popular song "Never Gonna Give You Up" in the 1980s. We amplitude modulated this song on a 32 kHz ultrasonic carrier wave. When we introduced a 25-kHz sine wave to interfere with this hidden ultrasonic channel, the IMD in the air produced a 7-kHz audible tone, accompanied by ripples related to the song's tone, which was then picked up by the recording equipment. After the computer plays the song, the software demodulates it.

This video shows the results of our "rickroll" covert operation:

One thing to note in the video is that the metallic sound around 7 kHz can only be heard where the two signals cross. When the signals do not intersect, you cannot hear the 7 kHz tones, but the demodulator can still play hidden songs. This finding is consistent with reports by some diplomats in Cuba: the voices they hear are often limited to a part of the room. Just a few steps out, the sound stopped abruptly.

So if the sound source in Cuba were ultrasound, what would they be? There are many sources of ultrasound in the modern world. In Michigan, our office is bathed in a 25 kHz signal from a ceiling-mounted ultrasonic room occupancy sensor. We have removed the equipment closest to our laboratory equipment, but just last month we discovered a new equipment. [To learn more about the difficulties we have with these sensors, please refer to "How Ultrasonic Sensors Almost Derailed the Doctor". paper. ”] Another source is ultrasonic insect repellent for rodents and insects. (This blog post describes a family encountering this device at Havana Airport.) And some cars contain ultrasonic transmitters.

Although the equipment we used in the Cuban re-creation is relatively heavy, the ultrasonic transmitter can be very small, no bigger than a piece of Rolo candy. On the Internet, we found a Russian manufacturer that sells a stylish leather clutch that hides an ultrasonic transmitter, which may interfere with the recording equipment of a cocktail party. We also found that electronics stores sell high-power ultrasonic jammers, which can cause microphone malfunctions. An advertising jammer will emit 120-dB ultrasonic interference within a distance of 1 meter. It's like standing next to a chainsaw. If the signal from this caliber jammer is combined with a second ultrasonic source, it may produce audible by-products.

Although mathematics leads us to believe that intermodulation distortion may be the culprit in the Cuban case, we have not ruled out other invalid assumptions that may cause discomfort to diplomats. For example, maybe the tone people hear does not cause their symptoms, but just another symptom that is a clue to the real cause. Or these sounds may have some non-auditory effects on people's hearing and physiology through bone conduction or other known phenomena. Microwave radiation is another theory. If more computer scientists master embedded security, signal processing and system engineering, then a positive result of all this will be.

Even if our assumptions are correct, we may never know the final story. The parties responsible for the ultrasonic transmitters now know that their devices are the culprit and will remove or deactivate them. But whether our assumptions are correct or not, one thing is clear: Ultrasonic transmitters produce audible by-products that may inadvertently harm diplomats. In other words, bad engineering may be more likely to be the culprit than sonic weapons.

Kevin Fu is an IEEE Fellow and Associate Professor of Computer Science and Engineering at the University of Michigan, Ann Arbor, where he leads the security and privacy research team. He is also the chief scientist of Virta Labs, a healthcare cybersecurity startup. Xu Wenyuan, Professor and Dean of the Department of Systems Science and Engineering, Zhejiang University. Xu's Ubiquitous System Security Laboratory (USSLab) has twice been recognized by the Tesla Security Researcher Hall of Fame. Chen Yan is a doctor. Student at Zhejiang University.

The author’s technical report "About Cuba, Diplomats, Ultrasound and Intermodulation Distortion" [PDF] (Technical Report CSE-TR-001-18, University of Michigan, Computer Science and Engineering, March 1, 2018) More detailed information about the simulation and experiments on reverse engineering of the Cuban Embassy "sonic weapon".

Associated Press News' Josh Lederman and Michael Weissenstein were the first to report on the Cuban recording, in "Dangerous Voices? What the Americans heard during the Cuban attack", October 13, 2017.

For more information on how to synthesize sounds using intermodulation distortion, see "Sound Synthesis and Auditory Distortion Products" by Gary S. Kendall, Christopher Haworth, and Rodrigo F. Cádiz, Computer Music Journal, 38(4), Ma Provincial Institute of Technology Press, Winter 2014.

Many people believe that Cuba may be using microwaves instead of ultrasound. For example, see James C. Lin's article "Weird Reports of Cuban Weaponized Voices", IEEE Microwave Magazine, January/February 2018, pages 18-19. The remaining question is whether microwaves can produce high-pitched sounds recorded in Associated Press news videos by smartphones.

It should be remembered that a normal (active) mobile phone in a normal operating position near the ear has caused a weak low-frequency signal (second-order PIM for envelope demodulation) through passive intermodulation, which can perform well on biological tissues In vivo measurement; the signal is in the range of 1 microvolt in the brain; for higher (microwave) peak powers, the associated low-frequency signal may be significantly higher and will appear in addition to the well-known microwave auditory effect. On the other hand, since more than 50 years (for example, Moscow), the microwave sweep of the US embassy has been widely known, so every embassy should have simple microwave detectors or similar instruments...so Cuba may be more like Is ultrasound..

Your weekly selection of wonderful robot videos

Video Friday is your weekly selection of wonderful robot videos, collected by IEEE Spectrum Robotics friends. We will also publish a weekly calendar of upcoming robotic events in the coming months; this is what we currently have (send us your events!):

If you have any suggestions for next week, please let us know and enjoy today’s video.

The funniest robot video of the week is here.

I am very grateful that KUKA actually used real robots to throw real liquids, although to be honest, I am expecting more, do you know?

Two new videos highlight the performance of DeepRobotics’ Juying X20 quadrupeds.

Jueying X20 Quadruped Robot Load Test: What happens when a boy weighing 75 kg stands up? www.youtube.com

A speech by Ali Agha of JPL from DARPA SubT Team CoSTAR, on the autonomy of flexible robots under uncertainty, which is part of the CMU Tartan SLAM series.

Prototype flexible batteries now match the power/weight ratio of the best commercial thin film devices

Prachi Patel is a freelance journalist based in Pittsburgh. She writes articles on energy, biotechnology, materials science, nanotechnology and computing.

Photo of WSe2 solar cell on a flexible polyimide substrate.

Silicon occupies a dominant position in the solar field, but it is not the best material for making thin and light solar cells needed for satellites and drones.

Atomic-level thin semiconductor materials such as tungsten diselenide and molybdenum disulfide have been considered for use in next-generation electronic products, and are expected to be used in low-cost and flexible ultra-thin solar cells. Now, engineers have produced tungsten diselenide solar cells with a power-to-weight ratio comparable to mature thin-film solar cell technology.

The photoelectric conversion efficiency of flexible solar cells reported in the journal Nature Communications is 5.1%, which is the highest report of such flexible cells. At the same time, their specific power is 4.4 W/g, which is comparable to thin-film solar cells, such as thin-film solar cells made of cadmium telluride, copper indium gallium selenide, amorphous silicon and III-V semiconductors. Koosha Nassiri Nazif, an electrical engineer at Stanford University, said that through engineering to further reduce substrate thickness and increase efficiency, the technology may reach 46 W/g, "far exceeding the level shown by other photovoltaic technologies." Together with his colleague Alwin Daus led the work.

It is a thousand times thinner than silicon, but the absorption is the same as that of a standard silicon wafer.

The efficiency of silicon is difficult to match in terms of cost, and the cost of silicon solar panels is declining every year. But "for emerging applications, silicon is not the most ideal," Nassiri Nazif said. These applications include wearable and comfortable electronics, smart windows and other construction uses, unmanned aerial vehicles and electric vehicles. "Another important application is the Internet of Things," he said, "where you can extend battery life or completely eliminate the need for batteries to power small sensors and devices."

He said that high specific power is essential for these applications. Today's thin-film technology and newer perovskite solar cells have a higher specific power than silicon, and perovskite holds a record of 29 W/g.

But tungsten diselenide and molybdenum disulfide belong to a class of materials called transition metal dichalcogenides (TMD), which have advantages over other materials. They are lighter than thin-film CdTe or CIGS batteries currently used in aerospace. They are also more stable than perovskites and organic photovoltaic materials, and more environmentally friendly than lead-containing perovskites.

In addition, TMD materials have the highest light absorption capacity of any photovoltaic material. "So you can have an ultra-thin layer that is a thousand times thinner than silicon and still have the same absorption through proper optical design," Nassiri Nazif said.

However, the best TMD solar cells to date have an efficiency of less than 3%, while the efficiency when fabricated on a lightweight, flexible substrate is less than 0.7%. However, the theoretical efficiency of this material is 27%. Daus said that they are only updating on site and need more heavy engineering to improve efficiency. All photovoltaic materials face the challenge of charge extraction. That is, once the material absorbs photons and generates electrons and holes, these charge carriers must be quickly extracted before they can recombine.

The trick is to find the right contact material to transfer the charge carriers from the semiconductor to the electrode. The researchers chose transparent graphene sheets for this. Daus explained that they then coated it with a molybdenum oxide layer, which was also transparent and enhanced the graphene’s ability to extract charge carriers.

He added that another key advancement that allowed them to manufacture high-quality flexible solar cells was the transfer method they developed. They first deposited a thin sheet of tungsten diselenide on a silicon substrate, deposited gold electrodes on it, and then coated it with a thin flexible plastic substrate. Then they put the entire system in a water bath and gently peeled off the flexible structure from the silicon wafer. Finally, they flipped the structure, put tungsten diselenide on it, and coated it with graphene and molybdenum oxide. The entire device is only 350 nm thick in the end.

Nassiri Nazif pointed out that the solar cell is very small at this time, about 100 x 100 µm. "In order to be commercially viable, we need at least 1 x 1 cm equipment," he said. "The good news is that large-scale, high-quality TMD growth has been shown."

But most of the effort is focused on making single-layer TMD materials for electronic products, Daus said, and for solar cells, you need thicker 100-200 nm films. The team at Stanford University has started to make 2 x 2 cm TMD films, but so far, the thicker films have not reached the same quality as the smaller flakes they used in the paper

They hope this work will stimulate more research in the field of TMD solar cells. "Our goal is to lay the foundation for TMD photovoltaic applications," Nassiri Nazif said. "Compared with other technologies, these materials have fundamental advantages. If we solve engineering problems, it may become the material of choice for the next generation of photovoltaic technology."

This technical paper reviews the importance of accurate modeling of surface topography changes after electrochemical deposition for optimizing chemical mechanical polishing simulation. Siemens EDA and the American University of Armenia have collaborated to evaluate the use of machine learning (ML) modeling techniques to predict these complex terrain changes. Modeling the postECD surface profile using various ML methods allowed them to determine which models provided the best combination of runtime and accuracy.