Researchers find way to listen in on headphones from afar

Researchers from The Hong Kong University of Science and Technology have developed a method to surreptitiously listen to audio signals transmitted by headphones and other devices. This technique, called InjectEave, involves injecting electromagnetic (EM) signals into analog components within devices like headphones, landline handsets, and smart devices. By doing so, the researchers were able to recover headphone audio from up to 30 meters away, even through walls.

The InjectEave attack is an EM side-channel attack, which overcomes the challenge of capturing faint RF signals in low-power devices. The attackers transmit a signal in the 0-9 MHz range, which can modulate an otherwise difficult-to-detect audio signal, making it detectable by nearby equipment. The researchers tested the technique on 11 commercially available devices, including Sony, Apple, Philips, HP, and smart devices such as fans and lamps.

The attack targets non-linear components commonly found in computer systems, such as amplifiers, analog-to-digital converters, power converters, and switching MOSFETs. These components create a modulated signal that can be detected by the adversary, enabling audio eavesdropping. Conducting an InjectEave attack requires commodity RF equipment, including a software-defined radio, antennas, a spectrum analyzer, a laptop, and optionally an RF power amplifier to increase the attack range.

The researchers emphasize that InjectEave is not affected by digital defenses such as encryption, masking, and randomization, as the leakage occurs in the analog path. They recommend hardware-aware mitigations like twisted-pair wiring, shielding, and filtering to reduce the energy coupled into the device, but they acknowledge these measures may not guarantee complete immunity.