Attacking Electric Motors for Fun and Profit

Overview: This presentation introduces a comprehensive threat model for attacking electric motors deployed across robotics, drones, and SCADA industrial systems. The speaker contrasts traditional safety controls—which manage accidental physical failures—with security controls focused on mitigating intentional adversarial manipulation. Using a commercial drone delivery fleet as a case study, the talk explores how exploiting motor drive electronics can induce kinetic damage, catastrophic overheating, and hardware destruction.

Key Topics: - Threat modeling motion systems: Industrial SCADA, autonomous drones, and robotics - Safety controls versus security risks in moving electro-mechanical systems - Pulse Width Modulation (PWM), duty cycle manipulation, and motor electrical physics - Motor operational limits: Stall torque, no-load conditions, and unauthenticated control paths

Technical Details: The presentation frames its threat model around a hypothetical worldwide package delivery fleet operating over 30 proprietary drone models managed by hundreds of operators. The analyzed systems rely on dual communications channels (4G LTE over the Internet and 2.4 GHz line-of-sight wireless), onboard sensor arrays (GPS, accelerometers, inertial measurement units), and a central Linux-based controller communicating with Electronic Speed Controllers (ESCs). In motion systems, safety frameworks governed by bodies such as the FAA rely on training and deterministic failsafes for unexpected physical events, but fail to account for deliberate cyber sabotage.

At the physical and electronic layer, all electric motors connect to drives—such as ESCs, Variable Speed Drives (VSDs), or Variable Frequency Drives (VFDs)—that supply electrical power. Motor speed and torque are modulated via Pulse Width Modulation (PWM), which toggles voltage at specific clock frequencies. The proportion of time voltage remains active during each switching cycle defines the duty cycle, which is governed through hardware and software routines. Electrical current flowing through motor windings interacts with permanent magnets to create an electromagnetic field between the stationary stator and moving rotor, converting electrical input into mechanical power.

Analyzing motor datasheets (such as brushed DC motors) reveals critical operating extremes: "stall torque," where torque is maximized while rotational speed is zero, and "no-load" conditions, where speed is maximized at zero torque. The speaker demonstrates that prolonged operation under stall torque conditions forces high continuous current draw through internal windings, rapidly overheating the motor, burning out electrical components, and causing physical fires. Crucially, digital control signals regulating PWM duty cycles across ESCs and motor drives lack cryptographic authentication. An attacker gaining access to the flight controller or drive interface can manipulate duty cycles and clock timings, weaponizing normal control loops to induce physical stall conditions or in-flight mechanical failure.

Key Takeaways: Control links driving Electronic Speed Controllers and motor drives require cryptographic authentication and command integrity checks to prevent unauthorized manipulation of PWM parameters. System architects must implement hardware-level thermal cutoffs and current-limiting safeguards that operate independently of software controllers to prevent catastrophic burnouts caused by forced stall torque states. Threat models for autonomous and robotic vehicles must treat physical actuator dynamics and electrical drive buses as critical attack surfaces.

(AI summary — Gemini Flash)