IEEE Consumer Electronics Magazine - March/April 2020 - 44

Consumer Electronics Security

Figure 4. Measured positions and orientations
during a manipulation attack. The horizontal axis
shows samples collected over time. Since the
headset was not moving, changes in position and
pose correspond to the error due to attack.

Sync Pulse Attack With Sensing
Fake pulses could also be generated to modify the actual sync sequence by using sensors
and microcontroller interrupts to detect the rising edges of the sync pulses. Since actual pulses
vary from 62 to 135 ms, we use the pulse duration
of 50 ms to ensure that the fake pulse interferes
with the system. The detailed process is shown
in Algorithm 1. Even though we did not differentiate whether a pulse is a sync flash or a rotating
laser sweep, this attack was enough to jam the
tracking system every time it was launched. We
have shown that using a smart attacking device
with sensors (IR detectors), an attacker can jam
the VR tracking system with certainty.
Algorithm 1. Algorithm for Smart Jamming.
Input: Detection of the pulses (both rotating laser
sweeps and sync pulses) of the actual system.
Output: A sequence of control signals provided to
the IR LEDs that produce fake sync pulses.
1. repeat forever
2.
Wait for start of any pulse of the actual
system.
3.
Generate a pulse with on-time of 50 ms.

Position and Orientation Manipulation
The last attack only jams the tracking system. However, it is possible to launch more

sophisticated attacks to manipulate the pose
estimation. When two consecutive real pulses
are identified as sync pulses, start of a new cycle
can be identified and we can now set our reference time with the actual system. We launched
a position and orientation manipulation attack
by generating a fake sync pulse before the start
of actual pulse. This attack method is shown in
Algorithm 2. We started the pulse at a time randomly sampled from 8200 to 8300 ms (the real
one starts at 8333 s. The on-time of the pulse
was 65 ms. The position and orientation during
the attack are shown in Figure 4. Since the headset was set at a fixed position, any change is
strictly due to the attack. Deviations from the
true values, as defined in (1) and (2), are shown
in Figure 5. As shown, this attack can induce
error of more than 3:5 m in position and around
10 in orientation.

Algorithm 2. Algorithm to Manipulate the
Position and Orientation Measurements.
Input: Detection of the pulses (both rotating laser
sweeps and sync pulses) of the actual system.
Output: A sequence of control signals provided to
the IR LEDs that produce fake sync pulses.
Initialize: synchronized false
1. repeat forever
2. if synchronized == false
3.
ts
start time of input pulse
4.
if two consecutive sync pulses are detected
5.
time reference tref
ts
6.
synchronized true
7.
end if
8. else if synchronized == true
9.
tnonce
a random number uniformly sampled
from 8200 to 8300.
10. generate sync pulse at time tref þ tnonce ms.
11. end if

COUNTERMEASURES
Intrusion Detection
A simple intrusion detection system can flag
an attack if it detects any patterns different from
the expected timing model. The detection of
jamming signals is simple: if there are more than
two IR light sources (i.e., more than two sync
pulses), it implies there is a malicious device
nearby. This is based on the fact that an
unwanted lighthouse signal cannot cause harm

IEEE Consumer Electronics Magazine

IEEE Consumer Electronics Magazine - March/April 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - March/April 2020