ABSTRACT
Loudspeakers are widely used in conferencing and infotainment systems. Private information leakage from loudspeaker sound is often assumed to be preventable using sound-proof isolators like walls. In this paper, we explore a new acoustic eavesdropping attack that can subvert such protectors using radio devices. Our basic idea lies in an acoustic-radio transformation (ART) algorithm, which recovers loudspeaker sound by inspecting the subtle disturbance it causes to the radio signals generated by an adversary or by its co-located WiFi transmitter. ART builds on a modeling framework that distills key factors to determine the recovered audio quality. It incorporates diversity mechanisms and noise suppression algorithms that can boost the eavesdropping quality. We implement the ART eavesdropper on a software-radio platform and conduct experiments to verify its feasibility and threat level. When targeted at vanilla PC or smartphone loudspeakers, the attacker can successfully recover high-quality audio even when blocked by sound-proof walls. On the other hand, we propose several pragmatic countermeasures that can effectively reduce the attacker's audio recovery quality by orders of magnitude.
- Z. C. Taysi, M. A. Guvensan, and T. Melodia, "TinyEARS: Spying on House Appliances with Audio Sensor Nodes," in Proc. of ACM BuildSys, 2010. Google ScholarDigital Library
- L. Zhuang, F. Zhou, and J. D. Tygar, "Keyboard Acoustic Emanations Revisited," ACM Transactions on Information System Security, vol. 13, no. 1, 2009. Google ScholarDigital Library
- M. Backes, M. Dürmuth, S. Gerling, M. Pinkal, and C. Sporleder, "Acoustic Side-channel Attacks on Printers," in Proc. of USENIX Security, 2010. Google ScholarDigital Library
- D. Genkin, A. Shamir, and E. Tromer, "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis," 2014.Google ScholarCross Ref
- P. Castellini, M. Martarelli, and E. Tomasini, "Laser Doppler Vibrometry: Development of Advanced Solutions Answering to Technology's Needs," Mechanical Systems and Signal Processing, vol. 20, no. 6, 2006.Google Scholar
- S. Sen, B. Radunovic, R. R. Choudhury, and T. Minka, "You Are Facing the Mona Lisa: Spot Localization Using PHY Layer Information," in Proc. of ACM MobiSys, 2012. Google ScholarDigital Library
- Q. Pu, S. Gupta, S. Gollakota, and S. Patel, "Whole-home Gesture Recognition using Wireless Signals," in ACM MobiCom, 2013. Google ScholarDigital Library
- G. Wang, Y. Zou, Z. Zhou, K. Wu, and L. M. Ni, "We Can Hear You with Wi-Fi!" in Proc. of ACM MobiCom, 2014. Google ScholarDigital Library
- A. Davis, M. Rubinstein, N. Wadhwa, G. J. Mysore, F. Durand, and W. T. Freeman, "The Visual Microphone: Passive Recovery of Sound from Video," ACM Trans. Graph., vol. 33, no. 4, 2014. Google ScholarDigital Library
- D. Tse and P. Viswanath, Fundamentals of Wireless Communication. Cambridge University Press, 2005. Google ScholarCross Ref
- BIBentryALTinterwordspacingW. Klippel and J. Schlechter, "Measurement and Visualization of Loudspeaker Cone Vibration," 2006. {Online}. Available: http://www.aes.org/e-lib/browse.cfm?elib=13716BIBentrySTDinterwordspacingGoogle Scholar
- J. R. Stuart, "Noise: methods for estimating detectability and threshold," Journal of the Audio Engineering Society, 1994.Google Scholar
- M. Vorlander, Auralization: Fundamentals of Acoustics, Modelling, Simulation, Algorithms and Acoustic Virtual Reality. Springer, 2008. Google ScholarDigital Library
- X. Zhang and K. G. Shin, "E-Mili: Energy-Minimizing Idle Listening in Wireless Networks," Proc. of ACM MobiCom, 2011. Google ScholarDigital Library
- S. Sur, T. Wei, and X. Zhang, "Bringing Multi-Antenna Gain to Energy-Constrained Wireless Devices," in Proc. of ACM/IEEE IPSN, 2015. Google ScholarDigital Library
- J. Selva, "Functionally weighted Lagrange interpolation of band-limited signals from nonuniform samples," IEEE Transactions on Signal Processing, 2009. Google ScholarDigital Library
- "ARP Request Replay Attack," http://www.aircrack-ng.org/doku.php?id=arp-request_reinjection, 2010.Google Scholar
- A. Musa and J. Eriksson, "Tracking Unmodified Smartones Using Wi-Fi Monitors." Proc. of ACM SenSys, 2012. Google ScholarDigital Library
- "Introduction to Wi-Fi Wireless Antennas," http://compnetworking.about.com/od/homenetworkhardware/a/introduction-to-wifi-wireless-antennas.htm, 2015.Google Scholar
- "WiFi Signal Attenuation," http://www.liveport.com/wifi-signal-attenuation, 2015.Google Scholar
- V. Shrivastava, D. Agrawal, A. Mishra, S. Banerjee, and T. Nadeem, "On the (in)feasibility of Fine Grained Power Control," Mobile Computing and Communications Review, vol. 11, no. 2, 2007. Google ScholarDigital Library
- Rice University, "Wireless Open-Access Research Platform," http://warp.rice.edu/trac/wiki, 2013.Google Scholar
- Volo Wireless LLC., "Wideband UHF Daughter Card (WURC)," 2014.Google Scholar
- "WARPLab 7_3_0 Benchmarks," http://warpproject.org/trac/wiki/WARPLab/Benchmarks/WARPLAB_7_3_0, 2014.Google Scholar
- R. P. Muscatell, "Laser microphone," 1984, uS Patent 4,479,265.Google Scholar
- W. McGrath, "Technique and device for through-the-wall audio surveillance," 2005, uS Patent App. 11/095,122.Google Scholar
- J. Nanzer, Microwave and millimeter-wave remote sensing for security applications. Artech House, 2012.Google Scholar
- V. Chen, F. Li, S.-S. Ho, and H. Wechsler, "Analysis of Micro-Doppler Signatures," IEE Proceedings on Radar, Sonar and Navigation, vol. 150, no. 4, 2003.Google Scholar
- F. Adib, Z. Kabelac, D. Katabi, and R. C. Miller, "3D Tracking via Body Radio Reflections," in Proc. of USENIX NSDI, 2014. Google ScholarDigital Library
- F. Adib and D. Katabi, "See Through Walls with WiFi!" in Proc. of ACM SIGCOMM, 2013. Google ScholarDigital Library
- S. Narain, A. Sanatinia, and G. Noubir, "Single-stroke Language-agnostic Keylogging Using Stereo-microphones and Domain Specific Machine Learning," in Proc. of ACM WiSec, 2014. Google ScholarDigital Library
- P. Marquardt, A. Verma, H. Carter, and P. Traynor, "(Sp)iPhone: Decoding Vibrations from Nearby Keyboards Using Mobile Phone Accelerometers," in Proc. of ACM CCS, 2011. Google ScholarDigital Library
- Y. Michalevsky, D. Boneh, and G. Nakibly, "Gyrophone: Recognizing speech from gyroscope signals," in Proc. 23rd USENIX Security Symposium, USENIX Association, 2014. Google ScholarDigital Library
Index Terms
- Acoustic Eavesdropping through Wireless Vibrometry
Recommendations
LidarPhone: acoustic eavesdropping using a lidar sensor: poster abstract
SenSys '20: Proceedings of the 18th Conference on Embedded Networked Sensor SystemsPrivate conversations are an attractive target for malicious actors intending to conduct audio eavesdropping attacks. Previous works discovered unexpected vectors for these attacks, such as analyzing high-speed video of objects adjacent to sound sources,...
mmEcho: A mmWave-based Acoustic Eavesdropping Method
ACM TURC '23: Proceedings of the ACM Turing Award Celebration Conference - China 2023Acoustic eavesdropping on private or confidential spaces poses a significant privacy threat. While soundproof rooms can mitigate these risks to some extent, they are unable to counter sophisticated eavesdropping, which has gained attention in recent ...
Towards defending eavesdropping on NFC
Successful defense against eavesdropping on near-field communication (NFC) vastly depends on careful analysis of eavesdropping and adopting a suitable defense mechanism based on the analysis. However, such an analysis and such an adoption of a defense ...
Comments