6 ms·

paper: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28... video: https://www

paper: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28... video: https://www.youtube.com/watch?v=ez3o8aIZCDM https://www.youtube.com/watch?v=ez3o8aIZCDM "It’s no surprise that earbuds can function as microphones in a pinch [...] But the researchers took that hack a step further. Their malware [...] silently “retask” the computer’s output channel as an input channel, allowing the malware to record audio even when the headphones remain connected into an input-only jack and don’t even have a microphone channel on their plug."

laddng 10y ago
The link to the paper is dead. Is there a mirror? I am very curious to see it
- jloughry 10y ago
  Replace the %28 and %29 in the URL with parentheses ( ) and the paper loads correctly. The title is spelt like this: SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
  - replax 10y ago
    The error changes from not found to access denied.. Do you have a link to the paper?
    - sleepprogger 10y ago
      Use f.e google cache to read it: cache:http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28...
      - jloughry 10y ago
        HN missed the leading `cache:' and failed to make your link clickable. This ought to work: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fcyber.bgu.ac.il%2Fadvanced-cyber%2Fsystem%2Ffiles%2FSPEAKE%2528a%2529R.pdf http://webcache.googleusercontent.com/search?q=cache%3Ahttp%... (I'm getting `access denied' on the original now too, but the Google cache link works.)
- yurymik 10y ago
  They have removed parenthesis from the URL: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR....
knodi123 10y ago
Wait, if they "retask the computer’s output channel as an input channel", then why do they need for the headphones to "remain connected into an input-only jack"?
- chias 10y ago
  The author of the article intended to write "output-only". But even this is not quite right: it's by definition not an input-only jack, but rather a jack capable of both input and output (which the user may think is output-only), but that RealTek has quietly switched to input mode as a result of their malware. Really this title is alarmist. Only very specific hardware, and you'd have to not notice the sound stopped.
  - mark-r 10y ago
    Most people don't play sounds all day. But this does point to a viable defense, if the headphones are always playing something they can't be used to record.
    - chias 10y ago
      That's a good point. You would also need to leave your headphones plugged in while not playing sounds (I don't, but others might I suppose). Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. This is an interesting idea and something that the driver software should be more vigilant about, but it's definitely not something that would lead me to conclude the headline.
      - JadeNB 10y ago
        > Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. The article itself claims two orders of magnitude better reach: > In their tests, the researchers tried the audio hack with a pair of Sennheiser headphones. They found that they could record from as far as 20 feet away—and even compress the resulting recording and send it over the internet, as a hacker would—and still distinguish the words spoken by a male voice.
rz2k 10y ago
Could they also be repurposed for electroencephalogy?
- conjectures 10y ago
  Maybe. Perhaps it would be safest to also wrap them in tinfoil?

laddng 10y ago

The link to the paper is dead. Is there a mirror? I am very curious to see it

jloughry 10y ago
Replace the %28 and %29 in the URL with parentheses ( ) and the paper loads correctly. The title is spelt like this: SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
- replax 10y ago
  The error changes from not found to access denied.. Do you have a link to the paper?
  - sleepprogger 10y ago
    Use f.e google cache to read it: cache:http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28a%29R.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKE%28...
    - jloughry 10y ago
      HN missed the leading `cache:' and failed to make your link clickable. This ought to work: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fcyber.bgu.ac.il%2Fadvanced-cyber%2Fsystem%2Ffiles%2FSPEAKE%2528a%2529R.pdf http://webcache.googleusercontent.com/search?q=cache%3Ahttp%... (I'm getting `access denied' on the original now too, but the Google cache link works.)
yurymik 10y ago
They have removed parenthesis from the URL: http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR.pdf http://cyber.bgu.ac.il/advanced-cyber/system/files/SPEAKEaR....

knodi123 10y ago

Wait, if they "retask the computer’s output channel as an input channel", then why do they need for the headphones to "remain connected into an input-only jack"?

chias 10y ago
The author of the article intended to write "output-only". But even this is not quite right: it's by definition not an input-only jack, but rather a jack capable of both input and output (which the user may think is output-only), but that RealTek has quietly switched to input mode as a result of their malware. Really this title is alarmist. Only very specific hardware, and you'd have to not notice the sound stopped.
- mark-r 10y ago
  Most people don't play sounds all day. But this does point to a viable defense, if the headphones are always playing something they can't be used to record.
  - chias 10y ago
    That's a good point. You would also need to leave your headphones plugged in while not playing sounds (I don't, but others might I suppose). Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. This is an interesting idea and something that the driver software should be more vigilant about, but it's definitely not something that would lead me to conclude the headline.
    - JadeNB 10y ago
      > Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. The article itself claims two orders of magnitude better reach: > In their tests, the researchers tried the audio hack with a pair of Sennheiser headphones. They found that they could record from as far as 20 feet away—and even compress the resulting recording and send it over the internet, as a hacker would—and still distinguish the words spoken by a male voice.

rz2k 10y ago

Could they also be repurposed for electroencephalogy?

conjectures 10y ago
Maybe. Perhaps it would be safest to also wrap them in tinfoil?