5 ms·

EarSpy: Spying on Phone Calls via Ear Speaker Vibrations

65 points by simonpure 4y ago

karbjlnms 4y ago
Didn't Android already restrict access to accelerometer data by default?
dessant 4y ago
It's worrying that any website can access real-time data from sensors by default in Android browsers, and there is no option to deny access to these APIs in Firefox for Android and Samsung Internet. https://sensor-js.xyz/demo.html https://sensor-js.xyz/demo.html
- berkes 4y ago
  Looking at this page makes me think that it's probably possible to detect that (not what) people are speaking or typing. I placed my phone on the surface. And did see the numbers jank when I started typing. Then I left it at rest and said a loud "Booo!" and saw the numbers jump again. To confirm, I'd need to plot the numbers and do some statistical analysis, which is far too much work for me now :D
- commoner 4y ago
  Firefox's fingerprinting protection disables these sensors and shows no data in the demo, even on Android. To enable this feature, go to about:config and set privacy.resistFingerprinting to true: https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai... This feature is enabled by default on some Firefox forks like Mull.[1] On Android only, the release channel of Firefox disables about:config entirely,[2] but Firefox Beta and Nightly have about:config available. [1] Mull: https://f-droid.org/en/packages/us.spotco.fennec_dos/ https://f-droid.org/en/packages/us.spotco.fennec_dos/ [2] Please vote to remove this ridiculous restriction at https://connect.mozilla.org/t5/ideas/firefox-for-android-about-config/idi-p/8071 https://connect.mozilla.org/t5/ideas/firefox-for-android-abo...
hackernewds 4y ago
> In the gender recognition test, whose goal is to determine whether the target is male or female, the EarSpy attack had a 98% accuracy. The accuracy was nearly as high, at 92%, for detecting the speaker’s identity. When it comes to actual speech, the accuracy was up to 56% for capturing digits spoken in a phone call. “[This] accuracy still exhibits five times greater accuracy than a random guess, which implies that vibration due to the ear speaker induced a reasonable amount of distinguishable impact on accelerometer data,” the researchers said. this seems not to have any practical significance. and recognizing numbers (only 56%) of the time is practically still as good as guessing, and not useful, in the context of spying, without the spoken words
- dannyw 4y ago
  Some OTP codes can be sent via phone calls, and keep in mind this is just a research prototype. It's certainly plausible that improvements can result in higher accuracy.
- codeddesign 4y ago
  “whether the target is male or female, the EarSpy attack had a 98% accuracy” I guess the other 2% are “gender neutral”.
- messe 4y ago
  > this seems not to have any practical significance. and recognizing numbers (only 56%) of the time is practically still as good as guessing, and not useful, in the context of spying, without the spoken words If that accuracy is at the single digit level, then it's significantly better than guessing, which would yield a 10% accuracy. 56% would be good enough to capture a 4-digit OTP code more than 1/8 of the time.
lfodofod 4y ago
This attack is nothing new, has been endlessly discussed by the grapheneos team. An accelerometer is just a shitty microphone, even a camera can be a shitty microphone.
- 0_____0 4y ago
  I have actually used a (nice, high fidelity and sample rate) accelerometer as a mic. Rolloff is somewhere around 400Hz. Just popped the accel data into audacity and played it back.
anyfactor 4y ago
This reminds of how Helen Keller learned to communicate. The technique is called Tadoma[0]. > Tadoma is a method of communication used by deafblind individuals, in which the deafblind person places their little finger on the speaker's lips and their fingers along the jawline. The middle three fingers often fall along the speaker's cheeks with the little finger picking up the vibrations of the speaker's throat. [0] https://en.wikipedia.org/wiki/Tadoma https://en.wikipedia.org/wiki/Tadoma
jonpalmisc 4y ago
If you find this interesting, you may also like some of Mordechai Guri’s work: https://cyber.bgu.ac.il/advanced-cyber/airgap https://cyber.bgu.ac.il/advanced-cyber/airgap
anfractuosity 4y ago
I came across this paper recently 'mmSpy: Spying Phone Calls using mmWave Radars' which says 'mmSpy performs sensing of earpiece vibrations using an off-the-shelf radar device that operates in the mmWave spectrum (77 GHz, and 60 GHz).' There's a video with some audio samples here - https://www.youtube.com/watch?v=EuuXAfIYo04 https://www.youtube.com/watch?v=EuuXAfIYo04 The Ti dev boards are around ~£200 if I recall correctly.
- 0ct4via 4y ago
  Link to the paper, since you didn't provide one... https://www.cse.psu.edu/~mkg31/papers/mmSpy.pdf https://www.cse.psu.edu/~mkg31/papers/mmSpy.pdf
95014_refugee 4y ago
This is (very) old news, and responsible vendors have had mitigations in place for a long time now.

65 points by simonpure 4y ago

Didn't Android already restrict access to accelerometer data by default?

It's worrying that any website can access real-time data from sensors by default in Android browsers, and there is no option to deny access to these APIs in Firefox for Android and Samsung Internet. https://sensor-js.xyz/demo.html https://sensor-js.xyz/demo.html

berkes 4y ago
Looking at this page makes me think that it's probably possible to detect that (not what) people are speaking or typing. I placed my phone on the surface. And did see the numbers jank when I started typing. Then I left it at rest and said a loud "Booo!" and saw the numbers jump again. To confirm, I'd need to plot the numbers and do some statistical analysis, which is far too much work for me now :D
commoner 4y ago
Firefox's fingerprinting protection disables these sensors and shows no data in the demo, even on Android. To enable this feature, go to about:config and set privacy.resistFingerprinting to true: https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai... This feature is enabled by default on some Firefox forks like Mull.[1] On Android only, the release channel of Firefox disables about:config entirely,[2] but Firefox Beta and Nightly have about:config available. [1] Mull: https://f-droid.org/en/packages/us.spotco.fennec_dos/ https://f-droid.org/en/packages/us.spotco.fennec_dos/ [2] Please vote to remove this ridiculous restriction at https://connect.mozilla.org/t5/ideas/firefox-for-android-about-config/idi-p/8071 https://connect.mozilla.org/t5/ideas/firefox-for-android-abo...

hackernewds 4y ago

> In the gender recognition test, whose goal is to determine whether the target is male or female, the EarSpy attack had a 98% accuracy. The accuracy was nearly as high, at 92%, for detecting the speaker’s identity. When it comes to actual speech, the accuracy was up to 56% for capturing digits spoken in a phone call. “[This] accuracy still exhibits five times greater accuracy than a random guess, which implies that vibration due to the ear speaker induced a reasonable amount of distinguishable impact on accelerometer data,” the researchers said. this seems not to have any practical significance. and recognizing numbers (only 56%) of the time is practically still as good as guessing, and not useful, in the context of spying, without the spoken words

dannyw 4y ago
Some OTP codes can be sent via phone calls, and keep in mind this is just a research prototype. It's certainly plausible that improvements can result in higher accuracy.
codeddesign 4y ago
“whether the target is male or female, the EarSpy attack had a 98% accuracy” I guess the other 2% are “gender neutral”.
messe 4y ago
> this seems not to have any practical significance. and recognizing numbers (only 56%) of the time is practically still as good as guessing, and not useful, in the context of spying, without the spoken words If that accuracy is at the single digit level, then it's significantly better than guessing, which would yield a 10% accuracy. 56% would be good enough to capture a 4-digit OTP code more than 1/8 of the time.

lfodofod 4y ago

This attack is nothing new, has been endlessly discussed by the grapheneos team. An accelerometer is just a shitty microphone, even a camera can be a shitty microphone.

0_____0 4y ago
I have actually used a (nice, high fidelity and sample rate) accelerometer as a mic. Rolloff is somewhere around 400Hz. Just popped the accel data into audacity and played it back.

anyfactor 4y ago

This reminds of how Helen Keller learned to communicate. The technique is called Tadoma[0]. > Tadoma is a method of communication used by deafblind individuals, in which the deafblind person places their little finger on the speaker's lips and their fingers along the jawline. The middle three fingers often fall along the speaker's cheeks with the little finger picking up the vibrations of the speaker's throat. [0] https://en.wikipedia.org/wiki/Tadoma https://en.wikipedia.org/wiki/Tadoma

jonpalmisc 4y ago

If you find this interesting, you may also like some of Mordechai Guri’s work: https://cyber.bgu.ac.il/advanced-cyber/airgap https://cyber.bgu.ac.il/advanced-cyber/airgap

anfractuosity 4y ago

I came across this paper recently 'mmSpy: Spying Phone Calls using mmWave Radars' which says 'mmSpy performs sensing of earpiece vibrations using an off-the-shelf radar device that operates in the mmWave spectrum (77 GHz, and 60 GHz).' There's a video with some audio samples here - https://www.youtube.com/watch?v=EuuXAfIYo04 https://www.youtube.com/watch?v=EuuXAfIYo04 The Ti dev boards are around ~£200 if I recall correctly.

0ct4via 4y ago
Link to the paper, since you didn't provide one... https://www.cse.psu.edu/~mkg31/papers/mmSpy.pdf https://www.cse.psu.edu/~mkg31/papers/mmSpy.pdf

95014_refugee 4y ago

This is (very) old news, and responsible vendors have had mitigations in place for a long time now.