MobilBye: Attacking ADAS with Camera Spoofing
Dudi Nassi Raz Ben-Netanel Yuval Elovici Ben Nassi
Ben-Gurion University of the Negev
Abstract
Advanced driver assistance systems (ADASs) were developed to reduce the number of car accidents by issuing driver alert or controlling the vehicle. In this paper, we tested the robustness of Mobileye, a popular external ADAS. We injected spoofed traffic signs into Mobileye to assess the influence of environmental changes (e.g., changes in color, shape, projection speed, diameter and ambient light) on the outcome of an attack. To conduct this experiment in a realistic scenario, we used a drone to carry a portable projector which projected the spoofed traffic sign on a driving car. Our experiments show that it is possible to fool Mobileye so that it interprets the drone carried spoofed traffic sign as a real traffic sign.
Citation
@article{DBLP:journals/corr/abs-1906-09765,
author = {Dudi Nassi and Raz Ben{-}Netanel and Yuval Elovici and Ben Nassi},
title = {MobilBye: Attacking {ADAS} with Camera Spoofing},
journal = {CoRR}, volume = {abs/1906.09765}, year = {2019},
url = {http://arxiv.org/abs/1906.09765}, archivePrefix = {arXiv}, eprint = {1906.09765},
timestamp = {Thu, 27 Jun 2019 18:54:51 +0200},
biburl = {https://dblp.org/rec/bib/journals/corr/abs-1906-09765},
bibsource = {dblp computer science bibliography, https://dblp.org} }
Press
_svg.png){kind=logo}
.png){kind=logo}
FAQs
What is the novelty of this attack vector comparing to other adversarial attacks against road signs?
Other methods require the attacker to physically approach the road signs in order to apply the changes.
This method can be applied remotely by attackers.
What is the novelty of this research comparing to other adversarial attacks against road signs?
We did not use white box approaches. We used black box approaches and prove that they are effective against real ADAS.
Why does the car in the video does not accelerate?
Mobileye 630 is ADAS level 0 so it does not control the car.
Can the projected road signs could be projected invisibly?
We believe that infrared projection can also work.
What other interesting things you found?
It seems that the background color of the road sign does not matter. Mobileye 630 ignores background colors so "crazy" road signs can be used against it.
What was Mobileye's reaction to your study?
Mobileye claims that this method does not consider as spoofing because the system did exactly what it required to do given the projected sign.
What can be done against it?
We suggest verifiable road signs (read the paper)