EarSpy: Spying on Phone Calls via Ear Speaker Vibrations

This reminds of how Helen Keller learned to communicate. The technique is called Tadoma[0].

> Tadoma is a method of communication used by deafblind individuals, in which the deafblind person places their little finger on the speaker's lips and their fingers along the jawline. The middle three fingers often fall along the speaker's cheeks with the little finger picking up the vibrations of the speaker's throat.

[0] https://en.wikipedia.org/wiki/Tadoma

It's worrying that any website can access real-time data from sensors by default in Android browsers, and there is no option to deny access to these APIs in Firefox for Android and Samsung Internet.

https://sensor-js.xyz/demo.html

I came across this paper recently 'mmSpy: Spying Phone Calls using mmWave Radars' which says 'mmSpy performs sensing of earpiece vibrations using an off-the-shelf radar device that operates in the mmWave spectrum (77 GHz, and 60 GHz).'

There's a video with some audio samples here - https://www.youtube.com/watch?v=EuuXAfIYo04

The Ti dev boards are around ~£200 if I recall correctly.

If you find this interesting, you may also like some of Mordechai Guri’s work: https://cyber.bgu.ac.il/advanced-cyber/airgap

> In the gender recognition test, whose goal is to determine whether the target is male or female, the EarSpy attack had a 98% accuracy. The accuracy was nearly as high, at 92%, for detecting the speaker’s identity.

When it comes to actual speech, the accuracy was up to 56% for capturing digits spoken in a phone call.

“[This] accuracy still exhibits five times greater accuracy than a random guess, which implies that vibration due to the ear speaker induced a reasonable amount of distinguishable impact on accelerometer data,” the researchers said.

this seems not to have any practical significance. and recognizing numbers (only 56%) of the time is practically still as good as guessing, and not useful, in the context of spying, without the spoken words

Didn't Android already restrict access to accelerometer data by default?

This attack is nothing new, has been endlessly discussed by the grapheneos team. An accelerometer is just a shitty microphone, even a camera can be a shitty microphone.

This is (very) old news, and responsible vendors have had mitigations in place for a long time now.