TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves

TL;DR

TimeTravel demonstrates a novel real-time attack that manipulates device timestamps by acoustically exciting a target RTC's quartz crystal oscillator, producing controllable forward or backward timing drift. The approach leverages Lamb-wave propagation in solids and phase manipulation of the oscillator's electrical response, enabling drift rates at multiple scales and across multiple devices. Through experiments on nine RTC modules and seven commercial devices, the authors show drift successes up to 93% and robustness against common obstacles, with EM side-channel analysis enabling model identification and attack planning. The work motivates practical countermeasures, including alternative oscillators and vibration damping, and highlights safety and NTP synchronization considerations for real-world deployments. The findings have broad implications for any system relying on RTC-based timekeeping in safety- or financially-critical contexts.

Abstract

Real-time Clock (RTC) has been widely used in various real-time systems to provide precise system time. In this paper, we reveal a new security vulnerability of the RTC circuit, where the internal storage time or timestamp can be arbitrarily modified forward or backward. The security threat of dynamic modifications of system time caused by this vulnerability is called TimeTravel. Based on acoustic resonance and piezoelectric effects, TimeTravel applies acoustic guide waves to the quartz crystal, thereby adjusting the characteristics of the oscillating signal transmitted into the RTC circuit. By manipulating the parameters of acoustic waves, TimeTravel can accelerate or decelerate the timing speed of system time at an adjustable rate, resulting in the relative drift of the timing, which can pose serious safety threats. To assess the severity of TimeTravel, we examine nine modules and two commercial devices under the RTC circuit. The experimental results show that TimeTravel can drift system time forward and backward at a chosen speed with a maximum 93% accuracy. Our analysis further shows that TimeTravel can maintain an attack success rate of no less than 77% under environments with typical obstacle items.

Figures (22)

• Figure 1: IoT devices containing real-time clock.
• Figure 2: Experimental results on the backward drift of time.
• Figure 3: Experimental results on forward drift of time.
• Figure 4: The general design of the TimeTravel attack scheme.
• Figure 5: Undenoised signal FFT result (top) and denoised signal FFT result (bottom).