6 ms·

The author of the article intended to write "output-only". But even this is not quite right: it's by definition not an input-only jack, but rather a jack capab

• mark-r 10y ago
  Most people don't play sounds all day. But this does point to a viable defense, if the headphones are always playing something they can't be used to record.
  • chias 10y ago
    That's a good point. You would also need to leave your headphones plugged in while not playing sounds (I don't, but others might I suppose). Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. This is an interesting idea and something that the driver software should be more vigilant about, but it's definitely not something that would lead me to conclude the headline.
    • JadeNB 10y ago
      > Headphones also make a really crappy mic -- try it out by plugging them into a microphone jack (essentially what this malware emulates) and recording yourself: you'll need to hold them inches from your mouth to be intelligible. The article itself claims two orders of magnitude better reach: > In their tests, the researchers tried the audio hack with a pair of Sennheiser headphones. They found that they could record from as far as 20 feet away—and even compress the resulting recording and send it over the internet, as a hacker would—and still distinguish the words spoken by a male voice.
      • kuschku 10y ago
        > with a pair of Sennheiser headphones. And that's where this falls apart. While some people buy quality headphones, many will be using cheap, or rebranded low-quality headphones, like beats, or even no-name headphones.
        • Declanomous 10y ago
          One attack vector doesn't need to cover everyone. Developing many attack vectors as possible gives you the greatest chance that one of them will work against a particular target. As an example, lets say that a particular organization has taken a number of standard precautions to prevent audio from being recorded surreptitiously. They've banned cell phones and chosen computers without internal mics. The ability to record sound via the output jack would be huge. Besides, I bet beats would work just fine. The reason Sennheiser's worked so well is probably because they have a large speaker, whereas a ear bud has a pretty small speaker. A speaker being used to pick up audio is basically a dynamic mic, which are not very sensitive for a given size. So I'd expect something like Beats, or the cheapo AKGs I have connected to my audio jack right now to work quite well.
          • kuschku 10y ago
            > The reason Sennheiser's worked so well is probably because they have a large speaker The reason I’m singling out beats, and a few other cheap headphones is because those tend to add a DSP to boost the bass. That’s why it wouldn’t work with them.
        • sleepybrett 10y ago
          Some of the lower end Sennheisers are decidedly crappy.
        • geon 10y ago
          I have a pair of shitty Sennheizer headphones. Apparently they dilluted their brand a lot.
          • 10y ago
  • a3n 10y ago
    Why couldn't you switch between input and output fast enough that you can't hear the difference, prioritizing output, and get low fidelity but viable input?
    • mark-r 10y ago
      Producing output requires vibrating the headphone elements. That vibration will completely swamp any vibration induced by the sound in the room. Cutting the output long enough to dampen those vibrations will certainly be noticeable.
  • knodi123 10y ago
    If you're looking for the most viable defense, how about unplugging your headphones.
• mikeash 10y ago
  It says this hardware is used in most computers, so it doesn't sound very specific. Maybe they're overstating it though?
  • dom0 10y ago
    Most fully integrated audio codecs support this, including the common Realtek/RTL variety. Dedicated audio interfaces and more expensive cards are normally unable to do this, hardware wise.