Is Your 3D Printer Giving Away Your Secrets?

Imagine that James Bond places a smartphone next to a villain’s 3D printer with an app that translates the fabricator’s sounds into 3D data, allowing our hero to snag the secret CAD plans for an atomic detonation device. Although this Hollywood sequence itself may be a bit far removed from reality, the technology is not. Researchers at the University of California, Irvine (UCI), have demonstrated the ability to calculate CAD data based on the sounds that a printer makes while it’s producing an object.

In a study led by Mohammad Al Faruque, director of UCI’s Advanced Integrated Cyber-Physical Systems Lab, Al Faruque and his team sought to demonstrate that IP owners should concern themselves with the cybertheft of their designs not only online, but also in the physical world. Performing what the group calls an “acoustic side-channel attack,” Al Faruque and his team were able to reverse-engineer the acoustics of a 3D printer’s motions to determine the shape of the file that it was printing.

The current sent to a stepper motor results in a measurable sound that can be translated back into a 3D printer’s toolpath. (All images courtesy of UCI’s Advanced Integrated Cyber-Physical Systems Lab.)

The amount of power used is related to the load on the individual motors, as well as the printing speed and the amount of torque needed. As current is supplied to the electromagnet of a stepper motor on the X,Y or Z axis, the motor creates a sound and electromagnetic interference. This principle has been exhibited frequently with 3D printer owners writing G-code to correspond with certain musical numbers in order to program their machines to sing songs.

For each of the different variables involved, the UCI team developed corresponding algorithms.

The UCI team inverts this scenario, translating the motors’ noises into G-code, with which they can then determine the dimensions of the original CAD file. They liken the sound to a fingerprint, representing the speed of the nozzle and the motor being implemented. Al Faruque and his students tested their ability to reproduce a 3D printed object related to three variables: speed, distance and complexity. When copying a 3D print of a rough key shape, the group was able to obtain an accuracy of almost 90 percent.

Using a Printrbot 3D printer, a recording device and their algorithms, the UCI team was able to replicate a key shape with almost 90 percent accuracy.

As you might imagine, this is only the beginning of the research, so it’s possible that, with further refining of their algorithms, the UCI scientists would be able to increase this accuracy even further. While the team used a standard microphone recorder, they also see the potential for the creation of an app relying on the built-in mic of a smartphone that thieves could use to covertly capture 3D data.

A number of individuals have shown off the ability to 3D print working key replicas and demonstrated the associated security concerns. There are also virtual locksmith businesses hoping that people will begin to store digital copies of their keys in the cloud for later 3D printing, in case they lose their original set. This study is evidence that online encryption may not be enough to protect valuable CAD data, such as a key file or even IP from companies joining the 3D printing revolution. It’s also possible that given the increasing number of militaries around the globe that have begun to explore the additive manufacturing of weapons and spare parts, the James Bond scenario described above is not all that farfetched.

As Al Faruque explained in an interview with UCI News, “In many manufacturing plants, people who work on a shift basis don’t get monitored for their smartphones. If process and product information is stolen during the prototyping phases, companies stand to incur large financial losses. There’s no way to protect these systems from such an attack today, but there might in the future.” The researcher and his students, Sujit Rokka Chhetri and Jiang Wan, warn that to prevent this type of cybertheft, precautions may need to be taken in order to dampen the sound of a 3D printer—something that may be welcomed by every 3D printer owner.