Can Ultrasonic Waves Hijack Your VR, Drones, and Smart Devices?

Alibaba Cloud security researchers Wang Zhengbo and Wang Kang highlighted that sensors, especially MEMS components, represent a largely ignored attack surface for Internet‑of‑Things (IoT) devices.

Through a series of experiments they demonstrated that a narrow‑band ultrasonic signal of roughly 27 kHz can interfere with the normal operation of various consumer devices such as VR/AR headsets, smartphones, balance scooters, and drones. In nature, a common bottlenose dolphin emits ultrasonic waves ranging from 20 kHz to 220 kHz, illustrating the feasibility of such attacks.

At Black Hat USA, the duo delivered a 50‑minute presentation describing their findings and warning manufacturers about the potential safety risks, including possible physical injury to users.

Using a simple signal generator coupled with an ultrasonic emitter, they were able to cause VR headsets to rotate or shake, freeze the display of HTC Vive units, and make Oculus Rift screens spin. Balance scooters lost stability and could tumble, while drones were forced to crash. Even the iPhone’s built‑in level sensor could be disrupted.

The underlying mechanism exploits the fact that ultrasonic waves can vibrate the MEMS gyroscope and accelerometer inside these devices. The six sensor outputs (Gx, Gy, Gz, Ax, Ay, Az) become corrupted when the ultrasonic frequency matches the resonant frequency of the MEMS elements, leading to erroneous motion data.

To mitigate these physical‑layer vulnerabilities, the researchers recommend adding acoustic shielding or damping layers to block external sound from reaching MEMS components, and implementing active noise‑cancellation systems that emit counter‑phase sound to neutralize malicious ultrasonic signals.

This work underscores the importance of addressing physical security flaws in IoT products, beyond traditional software‑based attacks.