Negative pressure rooms, which are spaces within hospitals and labs that protect outside areas from exposure to lethal pathogens, can reportedly be disturbed by attackers with smartphones, according to researchers at the University of California, Irvine.

The researchers suggested that the mechanisms for controlling airflow into and out of biocontainment facilities can be “tricked” into functioning improperly by sound at a specific frequency — possibly placed within a popular song.

An overview of the attack model — A Wolf in Sheep’s Clothing. Source: Anomadarshi Barua et al.An overview of the attack model — A Wolf in Sheep’s Clothing. Source: Anomadarshi Barua et al.

"Someone could play a piece of music loaded on their smartphone or get it to transmit from a television or other audio device in or near a negative pressure room," explained the researchers. "If that music is embedded with a tone that matches the resonant frequency of the pressure controls of one of these spaces, it could cause a malfunction and a leak of deadly microbes."

Controlling the flow of fresh air into and the contaminated air out of a space is a function of a building’s heating, ventilation and air conditioning (HVAC) infrastructure and the HVAC systems in research and hospital facilities usually feature room pressure monitors that employ differential pressure sensors (DPSs) that measure the atmospheres in a room against those outside of the room.

According to the research teams, some DPSs are vulnerable to remote manipulation, posing a potential threat to biosafety facilities. As such, the researchers examined eight DPSs from five different manufacturers. The team determined that all eight DPSs operated with resonant frequencies in the audible range and are consequently subject to tampering.

"When sound waves collide with the diaphragms inside a DPS, it starts vibrating with the same frequency," the researchers explained. "An informed attacker can use this technique to artificially displace the diaphragm, changing the pressure reading and causing the whole system to malfunction."

Further, the researchers suggest that a negative pressure room can be manipulated wirelessly by attackers posing as maintenance personnel and placing an audio device inside or near a negative pressure room or embedding sound-emitting technologies into a DPS before being installed in a biocontainment facility.

To counter such assaults, the researchers suggest sound dampening via lengthening the sampling tube of a DPS's port by 7 m or enclosing the pressure port in a boxed structure, thereby reducing the sensitivity of the DPSs.

The article detailing the team’s findings, A Wolf in Sheep's Clothing: Spreading Deadly Pathogens Under the Disguise of Popular Music, was published in the Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security.

To contact the author of this article, email mdonlon@globalspec.com