TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves

TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves

Speakers: Jianshuo Liu

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=PXehr5Yf2DA

Overview

In a groundbreaking presentation at USENIX Security, Jianshuo Liu unveiled "TimeTravel," a novel physical vulnerability that allows malicious actors to manipulate a device's internal system time using precisely engineered acoustic waves. This research, a collaborative effort between the Chinese Academy of Sciences and Virginia Tech, exposes a critical flaw in Real-Time Clock (RTC) circuits, the ubiquitous components responsible for timekeeping in countless embedded devices. The significance of this work lies in its demonstration of a contactless and non-invasive method to alter fundamental timing mechanisms, a capability that could have profound implications across various sectors.

The TimeTravel attack leverages the piezoelectric effect within the quartz crystal oscillator—the heart of any RTC—to induce controlled timing drifts. By transmitting specific acoustic vibrations through solid materials, attackers can subtly shift the crystal's oscillation phase, causing the device's internal clock to run either faster or slower. This vulnerability is particularly concerning given the pervasive reliance on accurate timing in critical infrastructure, industrial control systems, medical devices, and IoT ecosystems, where even minor discrepancies can lead to severe operational failures, data corruption, or security breaches.

The research not only details the intricate physics behind this acoustic manipulation but also presents a practical attack methodology and robust experimental validation. It highlights how an attacker, with close proximity but without physical contact, can infer RTC conditions and execute targeted timing alterations. The findings necessitate a re-evaluation of current physical security paradigms for embedded systems and prompt manufacturers to consider novel defensive strategies against such sophisticated, non-traditional threats.

Background

▶ Watch: Introduction to TimeTravel attack and RTC vulnerability (0:00)

The accuracy of timekeeping is fundamental to the operation of nearly all modern electronic devices. At the core of this function in embedded systems is the Real-Time Clock (RTC) circuit. An RTC acts as a device's internal stopwatch, typically comprising a quartz crystal, a battery for continuous power, and a microcontroller to store and manage timestamps. The crucial component for generating stable, periodic time signals is the quartz crystal oscillator. Specifically, RTCs commonly employ a tuning fork shaped crystal oscillator with a resonance frequency of 32.768 KHz. This crystal is hermetically sealed within a metal can, with plated electrodes attached to its surfaces.

The principle behind the crystal's operation is the piezoelectric effect: when the crystal flexes, it generates an electrical charge. Conversely, applying an electrical field causes it to deform. In an RTC, the crystal is integrated into a Pierce oscillator circuit, which includes an inverting amplifier and two load capacitors, making the crystal behave like a very high Q (quality factor) inductor. This high Q factor means the crystal is incredibly sensitive; even minute physical energy, such as vibration at its resonant frequency, can produce a noticeable electronic response. When the amplitude of the sinusoidal signal generated by the crystal reaches a predefined threshold, a tiny digital counter in the microcontroller increments, thus keeping time.

The integrity of this timekeeping mechanism is paramount across a wide array of applications. In industrial settings, precise timing ensures the synchronized operation of robotic arms and industrial modules in manufacturing pipelines; any deviation could lead to abnormal product processing or even catastrophic equipment failure. In medical devices, accurate timestamps are vital for recording patient vital signs, where errors could have life-threatening consequences. Similarly, in IoT hubs, scheduled tasks for paired devices rely entirely on the RTC's accuracy. A vulnerability that allows for the manipulation of this fundamental timing mechanism without physical intrusion represents a significant security concern, challenging assumptions about the isolation and robustness of embedded systems.

Previous attempts to exploit the crystal's acoustic resonance, such as using an ultrasonic speaker tuned to the crystal's frequency through the air, proved ineffective. This failure was attributed to the large acoustic impedance mismatch between air and the crystal's sealed metal casing, preventing sufficient energy transfer. This initial hurdle highlighted the need for a different approach to bypass the physical protective measures and directly influence the crystal's oscillation.

Key Findings

▶ Watch: Discovery: Acoustic waves through solid media (4:56)

The pivotal discovery of the TimeTravel research lies in the realization that while airborne ultrasound struggles to penetrate the crystal's casing, acoustic waves propagating through solid media can effectively couple with the RTC crystal. This breakthrough bypasses the impedance mismatch issue encountered with airborne transmission. The researchers found that by placing a piezoelectric ceramic transducer against a solid surface (such as a laptop chassis) near the RTC hardware, and emitting precisely timed Lamb waves, they could induce additional vibrations in the crystal. This phenomenon was directly observed through glitches at the RTC crystal and, more significantly, the halting of time updates at certain moments.

The core insight is that these induced vibrations, when intermittent and delivered with specific initial phases, cause additional electrical resonance within the crystal. This resonance subtly shifts the edge trigger moments—the points at which the crystal's oscillating signal crosses the threshold to increment the time counter. By meticulously controlling these phase shifts, the attackers could either advance or retard the clock's progression, effectively making the system time run faster or slower.

This led to the formulation of a practical attack methodology:

1. Offline Parameter Database Construction: Attackers first characterize various solid materials by testing their properties (longitudinal and transverse wave speeds, wave numbers) and observing the resulting phase jitter (delta) induced by acoustic bursts. This creates a database of attack parameters.
2. Real-time RTC Phase Estimation: During an actual attack, a passive small H-field probe is used to log the electromagnetic (EM) signals leaking from the RTC crystal. This allows the attacker to estimate the instantaneous phase of the crystal's ongoing oscillation without direct contact.
3. Closed-Loop Phase Alignment and Burst Transmission: Based on the desired time drift and the estimated phase, the attacker calculates the necessary number of acoustic bursts, their duration, and the inter-burst gap. When the measured phase enters a pre-defined "launch window," a burst with the required initial phase is transmitted. This process is repeated in a closed loop, ensuring continuous alignment and controlled drift accumulation.

The key finding is the ability to precisely control the timing rate by intermittently injecting controlled phase jitter. These induced phase notches translate into earlier or later threshold crossings, accumulating into the intended forward or backward timing drifts. The research validates that this vulnerability is present in a wide range of RTC modules and commercial devices, demonstrating a high success rate and robustness against various environmental factors.

Technical Deep Dive

▶ Watch: Core idea: Shifting edge trigger moments for timekeeping (7:50)

The TimeTravel attack exploits the intricate electromechanical coupling within the quartz crystal oscillator of an RTC. When a piezoelectric ceramic transducer is placed against a solid surface, it emits ultrasonic vibrations that propagate as Lamb waves through the material. Unlike airborne sound, these guided waves can efficiently transfer energy into the solid medium, reaching the RTC crystal which is typically in close contact with the device's mainboard or chassis.

The researchers model the vertical vibration experienced by the target location (where the RTC crystal is) due to these propagating acoustic waves. If the ceramic transducer vibrates sinusoidally with a frequency omega and initial phase phi, the solid material at a distance x from the transducer and a horizontal distance z will experience a vertical vibration u(x,t). This function can be approximated as a sinusoidal form with the same frequency as the transducer. Since the RTC crystal is physically coupled to this vibrating surface, it too will vibrate up and down at the same frequency.

Crucially, acceleration is the second derivative of displacement. According to the piezoelectric effect, this mechanical vibration induces an additional electrical resonance within the crystal. This induced electrical resonance has a frequency comparable to the mechanical vibration frequency. The researchers observed an "interesting phenomenon": when they intermittently sent vibration signals with different initial phases, the electromagnetic (EM) signals emanating from the crystal showed corresponding phase shapes. This indicated that the external acoustic input was directly influencing the crystal's internal oscillation phase, which in turn dictates how the RTC keeps time.

The core of the attack method is based on this ability to induce and control phase jitter. The attack proceeds in two main phases:

1. Offline Parameter Building:

• The attacker first characterizes the specific solid material of the target device. This involves determining fundamental acoustic properties such as longitudinal wave speed (CL) and transverse wave speed (CT). These parameters are crucial for calculating alpha and beta, which are then used to derive the wave number (Ka) from guided wave equations.
• The vibration form is sinusoidal, and the amplitude (lambda) and phase (phi) of the induced vibration can be derived from these parameters.
• Through offline experimentation, the attacker tests different solid materials and observes the resulting phase jitter (delta)—the change in the crystal's oscillation phase—after applying acoustic bursts with varying parameters. This data is compiled into a database, mapping attack parameters to their expected phase jitter.

1. Real-time Closed-Loop Attack Execution:

• Passive EM Logging: During a live attack, the attacker uses a small H-field probe to passively monitor the electromagnetic leakage from the RTC crystal. This allows for the real-time estimation of the crystal's instantaneous oscillation phase (phi).
• Drift Calculation and Burst Planning: If a target time drift t is desired, the attacker consults the pre-built database to find the appropriate initial phase (phi) and per-burst jitter (delta). The number of bursts (k) required to achieve the desired drift is calculated using the formula: k ≈ ceil(t 2 pi * f0 / delta), where f0 is the nominal crystal frequency (32.768 KHz). The burst duration (t1) and inter-burst gap (t2) are also determined.
• Synchronized Burst Transmission: When the measured instantaneous phase (phi) of the crystal's oscillation enters a predefined "launch window," the ceramic transducer transmits an acoustic burst with the required initial phase.
• Closed-Loop Alignment: After each burst, the attacker repeats the EM sensing and phase estimation process to maintain alignment and ensure the cumulative phase jitter leads to the intended time drift.

The mechanism by which this works is that the injected acoustic bursts introduce controlled phase notches into the crystal's oscillation. These notches effectively shift the moments when the crystal's signal crosses the threshold for the digital counter. An earlier threshold crossing makes the clock run faster, while a later crossing makes it run slower. These minute, controlled shifts accumulate over time, resulting in the intended forward or backward time drift. The researchers also noted a practical "rule of thumb": thinner surfaces couple better, meaning fewer bursts are needed to achieve the same effect, likely due to more efficient energy transfer.

Demo / Proof of Concept

▶ Watch: Attack validation on devices, high success rate (10:30)

The TimeTravel attack was rigorously validated across a diverse range of hardware platforms, demonstrating its broad applicability and effectiveness. The researchers tested the attack on a variety of RTC modules, development boards equipped with RTCs, and crucially, two commercial devices. For each test, corresponding attack parameters were selected to induce specific forward or backward time drifts. These tests were repeated 100 times to ensure statistical significance, yielding a remarkable success rate of no less than 78%. This high success rate underscores the widespread vulnerability of current RTC implementations to this acoustic manipulation technique.

The robustness of the attack was further investigated by examining several practical factors:

1. Medium Thickness: Experiments showed a clear correlation between the thickness of the solid medium and the difficulty of the attack. Thicker materials made the attack more challenging, likely due to increased energy dissipation and attenuation of the acoustic waves.
2. Magnetic Sensing Distance: The effectiveness of passively sensing the RTC's EM leakage was evaluated. The attack success rate remained over 70% when the H-field probe was within 5 cm of the crystal. This suggests that an attacker does not need to be in direct contact or extremely close proximity to the device to monitor its internal state.
3. Obstacles and Clutter: The presence of nearby obstacles and environmental clutter was found to have little impact on the attack success rate, indicating that the guided wave propagation through the solid medium is largely unaffected by external obstructions that might block airborne signals.

Beyond these controlled experiments, the researchers also considered more practical factors relevant to real-world deployment:

• Material Properties: The type of solid material significantly influenced the attack. Soft, glossy polymers or thick rubber materials were found to require noticeably more energy (higher amplitude or longer bursts) to induce the same phase shift compared to rigid, thin solids. This emphasizes the importance of the offline profiling phase, where such material-specific parameters would be logged.
• Device Model Identification: In a real-world scenario, an attacker might first need to identify the target device model to prepare suitable attack parameters. The researchers demonstrated a method using EM leakage data collected at different probing distances. This data was then used to train a deep learning classification model. This model achieved an effective classification accuracy, indicating that device models could be identified from EM signatures, generally effective within a 5 cm distance with over 50% success rates under their physical settings.

Finally, the effectiveness of the attack was demonstrated on commercial devices. When launching the attack on a commercial BP monitor (blood pressure monitor) with different attack vectors, the device responded with varying readings, indicating that the crystal experienced different extents of phase jitters. This directly translates to manipulated medical data. The researchers also briefly tested a mini POS machine, with detailed timing drift results available in their full paper. These demonstrations highlight the tangible risks to consumer electronics and critical systems.

Defensive Implications

▶ Watch: Attack robustness: medium thickness and sensing distance (11:00)

The TimeTravel research not only exposes a novel physical vulnerability but also provides clear guidance for defending against such sophisticated acoustic attacks. The fundamental principle for defense is to either disrupt the energy being propagated to the crystal or avoid the frequency of the attack signal aligning with the crystal's oscillation frequency. Manufacturers and system designers have several options to mitigate this threat:

1. Utilize Higher Frequency Crystals: One robust defense mechanism involves using quartz crystals with significantly higher resonance frequencies, perhaps at the megahertz (MHz) level, instead of the common 32.768 KHz crystals. While the RTC still needs to output a 32.768 KHz signal, this can be achieved by coupling the high-frequency crystal with a Phase-Locked Loop (PLL) divider circuit. The rationale behind this is practical: it is substantially more difficult for an attacker to generate and precisely control ultrasonic vibrations in the megahertz range with sufficient power to influence such high-frequency crystals. The energy required and the complexity of acoustic wave generation at MHz frequencies make this a significant deterrent, effectively rendering the TimeTravel attack impractical.

1. Implement Shock-Absorbing Materials: A more direct physical countermeasure is to place shock-absorbing materials around the RTC crystal. Materials like sponge rubber are highly effective at dampening mechanical vibrations. By encapsulating or surrounding the crystal with such materials, the energy from external acoustic waves propagating through the solid chassis can be significantly attenuated before it reaches the sensitive crystal. This physical barrier prevents the induced vibrations necessary for the piezoelectric effect to cause phase shifts, thereby protecting the crystal from being affected by the acoustic energy. This approach focuses on isolating the crystal from its environment, preventing the acoustic coupling exploited by the attack.

These defensive strategies target different layers of the attack vector—either making the crystal inherently less susceptible to the attack's frequency range or physically shielding it from the attack's energy. Implementing a combination of these measures, especially in devices where timing accuracy is critical for safety, security, or regulatory compliance, would significantly enhance their resilience against TimeTravel and similar acoustic manipulation threats.

Key Takeaways

• RTCs are vulnerable to acoustic manipulation: Real-Time Clock circuits, integral to embedded devices, can be compromised by precisely targeted acoustic waves propagating through solid materials, not just air.
• Controlled timing drift is achievable: Attackers can induce specific "fast" or "slow" timing drifts by exploiting the piezoelectric effect in quartz crystals, altering the edge trigger moments of the oscillator.
• Attack relies on guided waves and phase control: The TimeTravel attack leverages Lamb waves transmitted via a ceramic transducer and requires careful, intermittent injection of acoustic bursts with specific initial phases to manipulate the crystal's oscillation phase.
• Offline profiling and real-time sensing are key: A practical attack involves offline characterization of target materials to build a parameter database, followed by real-time passive electromagnetic sensing to estimate the crystal's phase for closed-loop control.
• High success rate across diverse devices: The attack was successfully validated on various RTC modules, development boards, and commercial devices (e.g., BP monitors), demonstrating a high success rate (no less than 78%) and robustness to environmental factors.
• Defenses focus on isolation or frequency shift: Effective countermeasures include using higher-frequency crystals with PLL dividers (making acoustic attacks harder to generate) or physically shielding crystals with shock-absorbing materials like sponge rubber.

About the Speaker(s)

Jianshuo Liu (also referred to as Jen Shu in the transcript) is a researcher whose work focuses on the physical vulnerabilities of embedded systems, particularly concerning Real-Time Clock circuits. This presentation represents a joint research effort with the Chinese Academy of Sciences and Virginia Tech. Liu's expertise lies in uncovering novel, non-invasive attack vectors that exploit fundamental physical properties of hardware components, such as the piezoelectric effect in quartz crystals, to demonstrate significant security implications for critical timing mechanisms in various devices.