Ben Nassi * Yaron Pirutin* Adi Shamir ** Yuval Elovici * Boris Zadov*
*Ben-Gurion University of the Negev **Weizmann Institute of Science
Abstract
Recent studies have suggested various side-channel attacks for eavesdropping sound by analyzing the side effects of sound waves on nearby objects (e.g., a bag of chips and window) and devices (e.g., motion sensors). These methods pose a great threat to privacy, however they are limited in one of the following ways: they (1) cannot be applied in real time (e.g., Visual Microphone), (2) are not external, requiring the attacker to compromise a device with malware (e.g., Gyrophone), or (3) are not passive, requiring the attacker to direct a laser beam at an object (e.g., laser microphone).
In this paper, we introduce "Lamphone," a novel side-channel attack for eavesdropping sound; this attack is performed by using a remote electro-optical sensor to analyze a hanging light bulb's frequency response to sound.We show how fluctuations in the air pressure on the surface of the hanging bulb (in response to sound), which cause the bulb to vibrate very slightly (a millidegree vibration), can be exploited by eavesdroppers to recover speech and singing, passively, externally, and in real time.We analyze a hanging bulb's response to sound via an electro-optical sensor and learn how to isolate the audio signal from the optical signal. Based on our analysis, we develop an algorithm to recover sound from the optical measurements obtained from the vibrations of a light bulb and captured by the electro-optical sensor. We evaluate Lamphone's performance in a realistic setup and show that Lamphone can be used by eavesdroppers to recover human speech (which can be accurately identified by the Google Cloud Speech API) and singing (which can be accurately identified by Shazam and SoundHound) from a bridge located 25 meters away from the target room containing the hanging light bulb.
Threat Model
The sound snd(t) from the victim's room (1) creates fluctuations on the surface of the hanging bulb (the diaphragm) (2). The eavesdropper directs an electro-optical sensor (the transducer) at the hanging bulb via a telescope (3). The optical signal opt(t) is sampled from the electro-optical sensor via an ADC (4) and processed to a recovered acoustic signal snd*(t) (5).
Evaluation
We tested the performance of Lamphone attack in terms of its ability to recover speech and songs from a target location when the eavesdropper is not at the same location.
The target location was an office located on the third floor of an office building. Curtain walls, which reduce the amount of light emitted from the offices, cover the entire building. The target office contains a hanging E27 LED bulb (12 watt).
The eavesdropper was located on a pedestrian bridge, positioned an aerial distance of 25 meters from the target office. The experiments described in this section were performed using three telescopes with different lens diameters (10, 20, 35 cm). We mounted an electro-optical sensor (the Thorlabs PDA100A2, which is an amplified switchable gain light sensor that consists of a photodiode that is used to convert light to electrical voltage) to one telescope at a time. The voltage was obtained from the electro-optical sensor via a 16-bit ADC NI-9223 card and was processed in LabVIEW script that we wrote. The sound that was played in the office during the experiments could not be heard at the eavesdropper’s location
We placed three telescopes with different lens diameters (10, 20, 35 cm) on the bridge. The SNR that was obtained from the optical measurements obtained from each telescope and the acoustical measurements obtained from the microphone is presented in the next graph. Based on the results obtained we created an equalizer.
Sound Recovered From A Hanging Bulb
We recovered two songs and one sentence that were played via speakers in the office using optical measurements that were obtained from a single telescope.
Hear the recovered audio:
.png)
Citation
@article{nassilamphone,
title={Lamphone: Real-Time Passive Sound Recovery from Light Bulb Vibrations},
author={Nassi, Ben and Pirutin, Yaron and Shamir, Adi and Elovici, Yuval and Zadov, Boris} }
Talks
_svg.png){kind=logo}
FAQ
Q1: What is the difference between Lamphone and Visual Microphone?
Lamphone shows that high resolution data obtained by the Visual Microphone (a case in which a sample is an RGB matrix) is not required when using a hanging light bulb. Instead, we show that an electro-optical sensor that outputs information at a lower resolution (a one pixel sample) is sufficient to recover sound. As a result, Lamphone can be applied in real-time scenarios.
Q2: What is the difference between Lamphone and Laser Microphone?
Laser Microphone device requires an eavesdropper to direct a laser beam into a victim's room. As a result, it can be detected using a dedicated optical sensor that analyzes the directed laser beams reflected off the objects. Lamphone is totally passive, so it cannot be detected using a dedicated optical sensor that analyzes the directed laser beams reflected off the objects.
Q3: What is the difference between Lamphone and other related works that used devices that were located in proximity to a victim to recover sound (e.g., Gyrophone, Hard Drive of Hearing)?
Such methods require that eavesdroppers find ways of compromising devices (placed in physical proximity of a target/victim) in order to: (1) obtain data that can be used to recover sound, and (2) exifltrate the raw/processed data.
Lamphone is totally external, hence it does not require eavesdroppers to compromise a device.
Q4: How informative is the sound that can be recovered from vibrations of a bulb?
We were able to recover speech that was accurately transcribed by Google's Speech to Text API. We were also able to recover singing that was recognized by Shazam.
Q5: What is the maximal range that you were able to recover sound from?
We were able to recover sound from 25 meters.
This range can be amplified with proper equipment (bigger telescope, 24/32 bit ADC, etc.)
Acknowledgments
We would like to thank to David Hrishman and Idan Sokolovsky for their part in the preliminary research.