Hacker News Reader

Comment by degenerate | Hacker News Reader

Buried 4/5 down the page: "One limiting aspect of the described technique is that it requires a fairly loud conversation in the vicinity of the eavesdropping hard drive. To record comprehensible speech, the conversation had to reach 85 dBA, with 75 dBA being the low threshold for capturing muffled sound."

For context, a vacuum cleaner is also 75 decibels, with 80db as the threshold for hearing loss: https://ehs.yale.edu/sites/default/files/files/decibel-level...

So you literally have to scream at each other right in front of the hard drive for it to record discernible speech. This is not an "eavesdropping mic" as the subheading of the article claims. Therefore, it's yet another clickbait BS fearmongering article about an interesting tech hack.

View on HN

This is wrong. I'm a professional sound engineer who's done location recording for film for over a decade and has another decade's worth of studio/editing experience.

A vacuum cleaner is loud but not that loud. You don't have to scream over it. 80db will cause hearing loss if you listen to that level sustained over a long time, but it's not remarkably loud. In fact, the chart you link shows everyday examples of noises in that range like phones ringing, chamber music (from acoustic stringed instruments using resonant cavities, a good proxy for human voices), city traffic, and more.

While a 75dB noise floor is definitely a problem for obtaining a clean recording (the kind you hear in a tv show), it's nothing unusual in forensic work. The sound from the servos moving the heads back and forth will consist of aperiodic loud but relatively slow and brief transients. It'll be like trying to listen in to a space while a spastic Autechre track plays on a speaker nearby - hard work but not impossible. A more prosaic example would be trying to follow the words of an unfamiliar song or rap at a live concert.

I'm pretty confident that I could get what you said into your phone while you sat in front of your laptop with a mechanical hard drive, without even hearing any of their source material. I would find this easier than trying to deal with a bad recording made in high wind or in the vicinity of a diesel engine.

"A vacuum cleaner is loud but not that loud."

You can hear a Kirby vacuum over an opera concert with full symphony from over 100 yards away. I volunteer for a local SoCal group and have had to deal with such nasty interruptions many times.

Author here. I disagree that a straightforward report on computer science research qualifies as "clickbait BS fearmongering." Note the all caps subhead. That should make it clear there are limitations: GOOD ENOUGH TO RECOGNIZE MUSIC VIA SHAZAM IF YOU TURN IT UP TO 11. And as the researchers state in their paper, they expect the technique can be improved.

Does another team have control of the actual title?

Reporters submit suggested heds. Editors often change them.

OP is likely taking exception to the use of the word "eavesdropping", since it means listening to, specifically, conversations.

The researchers use that very word in the title of their paper: "Hard Drive of Hearing: Disks that Eavesdrop with a Synthesized Microphone"

Yeah, researchers are known to do this kind of thing to get more publicity for their research, they have career goals too after all.

It's research clickbait basically.

How much experience do you have with forensic audio analysis?

I'm looking forward to reading the paper and I know exactly how I'd deal with the noise reduction either manually or by piping it through a Cedar box (https://www.cedar-audio.com/ - I'm not affiliated with them).

I don't think most people realize how good forensic audio tools are in. Cedar stuff is expensive because it works in realtime (sub millisecond processing latencies!) and can be operated by anyone who is capable of manually tuning a radio.

Intriguing - do they use FPGAs or something for the processing?

Perhaps so, because those law latencies exceed what the best DACs on the market provided a few years ago, but I don't own any of their gear. I've always considered their hardware to be magic - I know what they're doing all the way down to understanding the mathematics of fourier transforms, and it still blows my mind.

The most basic FM radio still blows my mind.

Could the technique be used for something more localized, like sensing keystrokes via vibration? If an attacker knew a make/model of laptop, they could make a "training set" of data to compare against for greater confidence.

I really hate your use of ‘eggheads’ and similar crap. Just call them researchers ffs.

> So you literally have to scream at each other right in front of the hard drive for it to record discernible speech.

Right. Because certainly no one can figure out how to improve this.

How about using multiple hard disks simultaneously and use signal processing magic to clean it up, just like microphone arrays do?

Maybe you could even start to get some limited spatial information about the surroundings, based on sound arrival time difference between multiple disks? Similar to the way reflections of sound waves in the Earth crust and below can be used to compute Earth internal structure. Or how bats navigate.

I'm not saying these ideas work — most likely not. What I'm saying, that someone with this knowledge and some brilliant discovery might be able to take this technique way further.

> Maybe you could even start to get some limited spatial information about the surroundings,

Good point. I guess you could accurately triangulate the position of the hard drive using seismic reference data, in the case of an earthquake. Or you could make loud noises at different places in a city, and locate the hard drive that way.

I didn't mean that, but that's also an interesting idea.

You make 2 or 3 passes with a supersonic aircraft to get the location, and then one more pass to drop a bomb.

In a more civilian context, you have a nice fireworks show and then send the SWAT team.

Maybe a spy satellite passes overhead and records the data center walls vibrating.

Jokes aside, hearing a sound directly from a low orbit is a thing [0]. Only problem is, the sound has to be extremely loud.

[0] https://agupubs.onlinelibrary.wiley.com/doi/full/10.1002/grl...

According to the paper, the frequency has to be very low ~0.1 Hz.

And conversely the ISS makes sonic booms in its LEO, they're just very weak. Sonic murmurs.

Here's a Video of Brendan Gregg and Bryan Cantrill giving a demonstration of the effect

> https://m.youtube.com/watch?v=tDacjrSCeq4

I saw the post and immediately thought of this video, glad someone posted it!

Discussed at https://news.ycombinator.com/item?id=17388144

So far. Perhaps there are ways for it to still be useful, regardless. For example, you might care more about the binary state of sound vs no sound (learning the hours that someone or something is in operation).

It’s also really freaking cool, and an amazing way to make something that’s created for one purpose into a seemingly unrelated one.

"Fearmongering"? This is an exceedingly cynical and uncharitable take on the article, which literally says:

But look, let's be real: for the vast, vast majority of people, this is all just a cunning academic exploitation of hard drive technology. No one's really going to bug you via your spinning rust.

Eavesdropping: To secretly listen to a conversation.

The title is accurate. It's currently not the best or completely practical, but this type of attack will likely have room for improvement.

This one was better. https://en.wikipedia.org/wiki/The_Thing_(listening_device)

You mentioned vacuum cleaner which could happen to be perfect. Imagine knowing the exact day and time the house cleaning service comes by to your target.

Exactly - just because it can't pick up speech doesn't mean it's not useful. That it can pick anything up at all can be gamed to your advantage depending on the purpose.

This is precisely why I avoid any articles published by El Reg. They're essentially the The Daily Mail of the tech scene. You're far better off reading about this stuff from other sources.

> So you literally have to scream at each other right in front of the hard drive for it to record discernible speech.

That's how people routinely talk in our open office, so entirely plausible.

Typical middlebrow dismissal of every sidechannel attack ever.

But, "Attacks only get better."

Still pretty interesting without the need for conspiratorial bent.

What if you had samples from multiple hard drives in the same room? Could they be combined to provide a better signal than a sample from a single drive alone?

> Could they be combined to provide a better signal than a sample from a single drive alone?

It's not as simple as just combining them but yes, the second data point would be immensely helpful.

There is a principle I have learned over time in infosec. Attacks only get better over time. If the defender does nothing, it is a net bad thing.

And they get combined in novel and creative ways to create effective practical exploits.

This tool would probably be useful in conjunction with other tools or in specific conditions:

* A tool that can clear the noise from the hard disk, allowing a glimpse at some parts of the conversation

* When the computer is turned-off (assuming the listening device can stay on)

* Some areas in an Airport

* Construction areas

It is not impossible to be useful for some actors, but it does require specific conditions.

In my rig, both my work and home machines, the drive is also exposed to massive local fan noise, not to mention the case. At these sensitivities, footfalls, even keyboard typing, might be enough to mask voices.

It is all just another nail in the "spinning rust" coffin imho: A novel technique applicable only to a declining target base.

There's a volume measurement device in a bar I frequent (I'm here now), which hosts music in a very small venue. It's decently full right now (maybe 40-50 people) and there's music playing over the speakers (not live), and this device is reading 80-85db.

I'll update if a band plays tonight.

London tube trains are typically about 90-100db in the train when moving so it's not that freakily loud.

Reply on news.ycombinator.com