LIDAR Hacks Fairly Unlikely Attacks on Self-Driving Cars
To attack a self-driving car's LIDAR system, the hacker needs to physically be near the car and a solid object needs to be in front of the car. As Brad Templeton explains, other sensors in self-driving cars can more easily be compromised.
- If their LIDAR is not predictable about when it sends pulses, the attack can only create noise, not coherent ghost objects. The noise will be seen as noise, or an attack, and responded to directly. For example, even a few nanoseconds of random variation in when pulses are sent would cause any attempted ghost object to explode into a cloud of noise.
- LIDARs can detect if they get two returns from the same pulse. If they see that over a region, it is likely there is an attack going on, depending on the pattern. Two returns can happen naturally, but this pattern should be quite distinctive.
- LIDARs have been designed that scan rather than spin. They could scan in an unpredictable way, again reducing any ghost objects to noise.
- In theory, a LIDAR could send out pulses with encoded data, and expect to see the same encoded data back. This requires fancier electronics, but would have many side benefits - a LIDAR would never see interference from other LIDARs, and might even be able to pull out information away from the background illumination (ie. the sun) with a better signal to noise ratio, meaning more range. However, total power output in the pulses remains fixed so this may not be doable.
- Of course, software should be robust against attacks, and detect their patterns should they occur. That’s a relatively cheap and easy thing to do, as it’s just software.
This topic brings up another common question about LIDARs, which is whether they might interfere with one another when every car has one. The answer is that they can interfere, but only minimally. A LIDAR sends out a pulse of light, and waits for about a microsecond to see the bounce back. (At a microsecond, it means the target is 150 meters away.) In other to interfere, another LIDAR (or attack laser) has to shine on the tight spot being looked at with the LIDAR’s return lens during the exact same microsecond. Because any given LIDAR might be sending out a million pulses every second, this will happen - but rarely, and mainly in isolated spots. As such, it’s not that hard to tune it out as noise. To our eyes, the world would get painted with lots of laser light on a street full of LIDARs, but to the LIDARs, which are looking for a small spot to be illuminated for less than a nanosecond during a specific microsecond, the interference is much smaller.
Radar is a different story. Radar today is very low resolution. It’s quite possible for somebody else’s radar beam to bounce off your very wide radar target at a similar time. Auto radars are not like the old “pinging” radars used for aviation. They actually send out a constantly changing frequency of radiation, and look at the frequency of the return to figure out how long the signal took to come back - they must also solve for how much that frequency changed due to the Doppler effect. This gives them some advantage, as two radars using this technique should differ in their patterns over time, but it’s a bigger problem. Attack against radar is much easier because you don’t need to be nearly so accurate and you can often predict their pattern. Radars which randomize their pattern could be robust against interference and attack.
This article first appeared on Brad Templeton’s Robocars Blog.