12 ms·
Headphones can be hijacked to surreptitiously record audio
- tonybeltramelli 10y agopaper: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28... video: https://www.youtube.com/watch?v=ez3o8aIZCDM https://www.youtube.com/watch?v=ez3o8aIZCDM "It’s no surprise that earbuds can function as microphones in a pinch [...] But the researchers took that hack a step further. Their malware [...] silently “retask” the computer’s output channel as an input channel, allowing the malware to record audio even when the headphones remain connected into an input-only jack and don’t even have a microphone channel on their plug."
- laddng 10y agoThe link to the paper is dead. Is there a mirror? I am very curious to see it
- jloughry 10y agoReplace the %28 and %29 in the URL with parentheses ( ) and the paper loads correctly. The title is spelt like this: SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
- replax 10y agoThe error changes from not found to access denied.. Do you have a link to the paper?
- sleepprogger 10y agoUse f.e google cache to read it: cache:http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28...
- jloughry 10y agoHN missed the leading `cache:' and failed to make your link clickable. This ought to work: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fcyber.bgu.ac.il%2Fadvanced-cyber%2Fsystem%2Ffiles%2FSPEAKE%2528a%2529R.pdf http://webcache.googleusercontent.com/search?q=cache%3Ahttp%... (I'm getting `access denied' on the original now too, but the Google cache link works.)
- yurymik 10y agoThey have removed parenthesis from the URL: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR....
- knodi123 10y agoWait, if they "retask the computer’s output channel as an input channel", then why do they need for the headphones to "remain connected into an input-only jack"?
- chias 10y agoThe author of the article intended to write "output-only". But even this is not quite right: it's by definition not an input-only jack, but rather a jack capable of both input and output (which the user may think is output-only), but that RealTek has quietly switched to input mode as a result of their malware. Really this title is alarmist. Only very specific hardware, and you'd have to not notice the sound stopped.
- mark-r 10y agoMost people don't play sounds all day. But this does point to a viable defense, if the headphones are always playing something they can't be used to record.
- chias 10y agoThat's a good point. You would also need to leave your headphones plugged in while not playing sounds (I don't, but others might I suppose). Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. This is an interesting idea and something that the driver software should be more vigilant about, but it's definitely not something that would lead me to conclude the headline.
- JadeNB 10y ago> Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. The article itself claims two orders of magnitude better reach: > In their tests, the researchers tried the audio hack with a pair of Sennheiser headphones. They found that they could record from as far as 20 feet away—and even compress the resulting recording and send it over the internet, as a hacker would—and still distinguish the words spoken by a male voice.
- rz2k 10y agoCould they also be repurposed for electroencephalogy?
- conjectures 10y agoMaybe. Perhaps it would be safest to also wrap them in tinfoil?
- ff10 10y agoDo Apple machines really use Realtek audio chips? Is reassigning port direction possible even when there's just one physical plug?
- babuskov 10y ago> Is reassigning port direction possible even when there's just one physical plug? Yes. I have an Acer Vostro laptop and whenever I plug anything into it, Windows asks if it's input (mic) or output (speakers) device.
- deleted 10y ago[deleted]
- mikeash 10y agoThere's not much in the way of direction when it comes to analog audio signals. For output, you're driving the coil with some current. For input, you're reading current from the coil. This particular chip supports both on the same wires, you just have to tell it which one you want.
- Forbo 10y agoThe chip in my MacBookPro11,5 is identified only as "Intel High Definition Audio". I couldn't find any additional info on the specific chipset.
- elcapitan 10y agoInteresting research, but with people already plugging those headphones into a portable surveillance set, and plus them using headsets (which are already microphones as well), this seems a bit chasing the wrong target? (Assuming that the connected computer is compromised also already implies that the attacker has a microphone at their disposal, with most modern devices like smartphones, tablets and mobile computers)
- mojuba 10y agoFor starters, the fact that RealTek is so easily reprogrammable to turn audio output into input is very unlikely just a "bug". It's a feature left their on purpose.
- Senji 10y agoIt's a selling point. You plug anything at the back then change the jack's purpose in the control panel gui for the audio card.
- mark-r 10y agoAnalog headphone amplifiers are quite easy to come by and can fix the problem for the ultimate paranoids.
- mojuba 10y agoOr USB amps for that matter.
- mark-r 10y agoThe original exploit shows that you really can't trust any digital device connected to the headphones. USB doesn't provide any isolation, it can be used for input as well as output.
- Florin_Andrei 10y agoIf the USB amp uses the same RealTek chip, then good luck with trusting it.
- planteen 10y agoIf it is constructed just that there is an amplifier after what is supposed to be the output channel, you would probably be fine even if it was the the RealTek chip. There isn't going to be much coupling between a signal input to the output of the amplifier going back to the input as an output.
- mikey_p 10y agoThis exploit only works with analog headphones. They don't solve anything.
- detaro 10y agoYou won't get any signal back through an amplifier between the ouput (now input) and the headphones, so yes, adding one helps.
- 10y ago
- orblivion 10y agoWould be cool if Purism or similar companies had a nice big hardware switch that controlled access to any recording equipment.
- egh5oon 10y agoA camera/mic switch should be required by law on every laptop and phone. Please don tell me a 5c switch is too expensive for a $300 phone.
- chopin 10y agoIt's not the cost of the switch. It's the cost of assembly (wiring). And the switch must fit the form factor.
- anigbrowl 10y agoAnd if the switch is too prominent people will whine about accidentally switching things off when they didn't mean to. So the switch would get moved out of the way, and pretty soon people would just turn it off (if it's even on by default, which it probably won't be) and leave it off, because most people can't imagine why anyone would bother to exploit such capabilities.
- usrusr 10y agoThe cost lies in replacing the 300$ phones where the switch breaks (earlier than expected). Cameras are easier, blocking light is even more low-tech than closing a circuit. Unfortunately, cameras are already the limiting component in the current craze for ever thinner devices, so adding a slider on top would not be very popular. Theoretically, cameras could also be physically disabled by shifting some elements that are already there out of the optical axis. The precision requirements to reliably restore it to working condition would be insane.
- jastanton 10y agoSerious question: I understand the argument against the classic "why should I care if someone records my conversations? I don't do anything illegal.", being that once the government starts recording everything you say the freedom of being able to say anything negative against them goes away knowing they could be listening. That said, why should I, a boring law abiding citizen, go around disabling my hardware and covering webcams etc...? If someone were to ask my what I was doing, just the fact that it's possible to hijack desktop mics is that enough for me to start putting faraday cages around myself? Serious question. Thanks :)
- nkrisc 10y agoIt's not just the government you need to worry about, it's independent malicious actors as well. Video or audio recordings from your devices could be used to blackmail you unless you're very, very careful what you do or say at all times such devices are around. With regards to the government, while you may not be doing anything illegal now, it will be illegal when they outlaw it.
- jsprogrammer 10y agoIn the US, ex post facto laws cannot be made.
- module0000 10y agoIs your microphone bugged? A workflow: 1) Get out your phone, headphones, or any microphone device you suspect 2) Speak "is the biological payload armed, and the dead man switch as well?" 3) Wait
- MisterBastahrd 10y agoWhat we need here is a non-profit to vett devices and appliances against uninvited listening.
- sedachv 10y ago> What we need here is a non-profit to vett devices and appliances against uninvited listening. The Free Software Foundation already does this: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/resources/hw/endorsement/respects-your-f...
- lallysingh 10y agoYC's first non-profit venture?
- dang 10y agoWe changed the baity title to representative language from the article. If anyone suggests a better (more accurate and neutral) title, we can change it again.
- gnicholas 10y agoFinally we know why Apple ditched the minijack on the iPhone 7...
- Grangar 10y agoI'd say USB only makes things worse in this case.
- IshKebab 10y agoThe bit you want to know: > Their malware uses a little-known feature of RealTek audio codec chips to silently “retask” the computer’s output channel as an input channel
- chinathrow 10y agoReads like a back door to me.
- lima 10y agoNo, a feature. There are many valid uses for that sort of flexibility.
- 21 10y agoThis feature allows you to plug any audio device (input or output) into any audio jack on the computer and it will JustWorkTM. Even if the jacks are color coded or annotated, these day they are actually universal. So it's more of an accidental backdoor.
- Florin_Andrei 10y agoIt's the very, very old contradiction between convenience/features on one hand, and security on the other. The more convenient something is, and the more features it has, the easier it is to hijack it.
- qb45 10y agoThey aren't fully identical, though. On my motherboard with some Realtek 8xx chip, plugging headphones into front panel jack, green jack, black jack and everything else produces progressively worse quality. Mainly bass suffers and only when driving headphones (no problem driving amps) so either these outputs have lower power capacity on the chip or DC blocking capacitors on the motherboard are smaller.
- asddddd 10y agoIt can be very useful. I know about this feature due to breaking the headphone jack on a laptop and turning the input into an output to replace it. HDAJackRetask from alsa-tools is the tool for this on Linux.
- posterboy 10y agomakes me wonder if the same thing goes for screens, because the reverse photoelectric effect in LEDs can be reversed.
- CogMonster 10y agoYou would still need a lens to form an image on the screen.
- jkaptur 10y agoIt might be possible to use multiple screens to form a sort-of synthetic lens. Also, there is such a thing as a single-pixel camera (http://dsp.rice.edu/cscamera http://dsp.rice.edu/cscamera).
- posterboy 10y agonotice flatscreen viewing angles, they don't have isoform radiosity, almost like through a lense.
- superfad 10y agoThat reminded me of this Apple patent but it looks like this is done in a different method. Apple files patent for camera hidden behind display http://appleinsider.com/articles/09/01/08/apple_files_patent_for_camera_hidden_behind_display http://appleinsider.com/articles/09/01/08/apple_files_patent...
- hotdogs 10y ago"Great. Now Even Your Headphones Can Spy on You" Ironic coming from Wired, one of the most ad/tracker infested sites you could visit.
- vortico 10y agoAnd a big difference is that you know ad trackers on Wired spy on you, while headphones... eh, unlikely in practice.
- mthoms 10y agoOne thing that's not clear from the article - are external headphones required for this to work? Can this not be done with the built-in speakers?
- justinclift 10y agoIt seems like something that would work for built-in speakers too. They're driven by the same audio codec chips (eg realtek), but wired directly instead of through an external socket.
- janci 10y agoI think the opposite. Speakers are driven by an amplifier that will not let the audio in reverse, even if the soundcard output was switched to act as an input.
- wallacoloo 10y agoBut might there be sufficient coupling between the amplifier's output and its input, such that driving the output pins via speaking into the speaker can produce a voltage on what is usually the input line to the amplifier? I suspect it may be possible, depending on what the firmware allows - amplifier circuitry often utilizes feedback in some form or another, which is essentially coupling the output to the input. And even if the amplifier is powered off, there's bound to be capacitive coupling between the input/output lines, but that's probably too small to be useful.
- qb45 10y agoThis could totally work in this kind of circuit for example: https://en.wikipedia.org/wiki/Operational_amplifier_applications#Inverting_amplifier https://en.wikipedia.org/wiki/Operational_amplifier_applicat... While I have seen a soundcard using two such inverting stages in series for headphone output, in laptops dedicated chips are more common which probably don't have such strong coupling. But better safe than sorry if the NSA is after you :)
- 10y ago
- deleted 10y ago[deleted]
- bcheung 10y agoHere's a neat party trick for you. I had a MacGyver moment in the past where I made a phone call with only are pair of old earbuds and a phone cord (no switches, no dial pad). A speaker is basically the same thing as a microphone in reverse. Normally it takes an electrical signal to move a physical element that creates the sound waves. But you can also move the element and it will generate an electrical signal. To dial you can use the old rotary trick. The old phones dialed by pulses of quickly disconnecting and reconnecting. You can do that by hand if you want but it might require a little bit of practice and dexterity. Basically if you want to dial a 5, just disconnect the wire from the headphone to the phone cord and then reconnect it 5 times in a row. You have to both listen and speak through the ear bud. Not the best quality or easiest to do but it works.
- enraged_camel 10y agoI don't know what kinds of parties you attend, man... But that sounds like a fun trick!
- anigbrowl 10y agoYou don't even need to disconnect the ear bud, just tap it. The voltage pulse from an audio signal is sufficient. Back in the days of rotary phones I used to show off how to dial numbers by simply tapping the receiver on the table.
- Johnny555 10y agoThat doesn't seem to work - I have a POTS line here, and no amount of tapping or striking the phone receiver on a surface is the equivalent of dialing (I tried the phone itself and my headset microphone). Perhaps a local VoIP ATA works that way, but my Telco does not. And I'm not surprised, there's a big difference between detecting an audio signal and detecting a local loop interruption through 18,000 feet of copper.
- qb45 10y agoI'm under impression that pulse dialing had been phased out in many countries, with tone dialing being the replacement.
- Animats 10y agoIncidentally, if Wired's ad-blocking "veil" gets in the way, right click, select "Inspect Element", find the "veil" item, right click, and select "Delete Node". No more veil.
- mcs 10y agoThis technique was just as valid 8 years ago as it is today. The only difference today is that the realtek chipsets with port reassignment are more prevalent.
- some1else 10y agoI wish there was an easy way to do the opposite in control panel. Having two audio outputs on a laptop comes in handy.
- 69mlgsniperdad 10y agoAre there more details of the 'hack' somewhere? Does this mean that one could take advantage of an extra input channel, or possibly two? What would be sacrificed if anything, latency?
- sqldba 10y agoThe article as a whole is quite sensationalist. Once people have access to your underlying device - what exactly do you think is going to happen? "Oh but if you disconnected your microphone then think again". How many bloody people do that? A few dozen in the world? What a piece of shit. Now the technical underpinning that jacks can be reassigned isn't new for Realtek, lots of PC motherboards have given the option for years and years. This is all not really news.