Researchers discover how music can be used to trigger the release of deadly pathogens

Researchers at the University of California, Irvine have discovered that the safe operation of a negative pressure room—a space in a hospital or biological research lab designed to protect outside areas from exposure to deadly pathogens—can be circumvented by an attacker armed with less than a smartphone.

According to UCI cyber-physical systems security experts, who shared their findings with attendees of the Computer Society’s recent Conference on Computer and Communications Security in Los Angeles. , the mechanisms that control the flow of air in and out of biological containment facilities can be tricked into acting abnormally by a specific frequency sound, which can be surreptitiously inserted into a song famous.

“Someone can play a track loaded on their smartphone or stream it from a TV or other audio device in or near the negative. pressure room,” said co-senior author Mohammad Al Faruque, UCI professor of electrical engineering and computer science. resonant frequency of the pressure controllers of one of these spaces, it could cause a breakdown and leak of deadly bacteria.”

Heating, ventilation, and air-conditioning infrastructure maintains the flow of fresh air in and contaminated air out of a given space. HVAC systems in scientific facilities often include room pressure monitors, which in turn use differential pressure sensors to compare the atmosphere inside and outside the room.

Commonly used differential pressure sensors (DPS) are vulnerable to remote manipulation, the researchers say, posing a previously unknown threat to biosecurity facilities. They tested their hypothesis on eight industry-standard DPS from five manufacturers, demonstrating that all devices operate at resonant frequencies in the audible range and are therefore subject to tampering.

“When sound wave lead author Anomadarshi Barua, UCI doctoral candidate in electrical engineering and computer science. “A knowledgeable attacker could use this technique to artificially replace the diaphragm, change the pressure readings, and cause the entire system to malfunction.”

He said that attackers can disrupt the negative pressure room system in a variety of ways. They can control them wirelessly or pose as maintenance personnel to place audio equipment inside or near such a room. “A more sophisticated attack could involve the perpetrator embedding sound-emitting technologies into the DPS before it is installed in a biological containment facility,” Barua said.

In their conference presentation, the researchers proposed several countermeasures to prevent a musical attack on biosecurity facilities. Sound reduction can be achieved by extending the sample tube of the DPS port by 7 meters. The team also proposed placing the pressure gate in a box-like structure. Both of these measures will reduce the sensitivity of DPS, says Barua.

Al Faruque says that this research project exposes the vulnerabilities of embedded systems to random attacks but emphasizes that with a little planning and forethought, the foundations can be strengthened to against vandalism.

Joining Al Faruque and Barua in the study is Yonatan Gizachew Achamyeleh, UCI Ph.D. electrical engineering and computer science students. Research published as part of Proceedings of the ACM SIGSAC 2022 Conference on Computer and Communication Security.