Hacker News Reader

Comment by Akuehne | Hacker News Reader

This has some very interesting privacy and security risks. If the tech can do more complex frequency analysis, then couldn't it essentially be used as a microphone for a device that doesn't need permission.

View on HN

I thought this has been done to capture keystrokes of a keyboard next to the phone already

2011 https://www.researchgate.net/publication/221609349_spiPhone_...

It's a pretty well-known exploit that the CIA is capable of turning a lot of electronics with speakers into microphones. I imagine there is an entire classified backlog of things they can turn into microphones without the target's knowledge.

Tangent but the hidden no-electronics bug "The Thing / Great Seal Bug" really crazy

It had no internal power supply, it worked like an RFID tag, but it was electronic.

Tangentially, I didn't know this (from Wikipedia):

> The Thing was designed by Soviet Russian inventor Leon Theremin, best known for his invention of the theremin, an electronic musical instrument.

Yeah I was going for no battery

Idk though when I read it, it seems like it's literally an antenna attached to a can "resonator" is that electronics? It is I guess since it can carry an RF wave? Electronics I think of a chip or circuitry. I get it has to be some form of a circuit to work even as a monopole.

The article says it though: "...hung in his office behind his desk, and which contained an electronic device"

I think if you saw it on a bench hooked up to wires, it would be intuitive that it was a circuit. It's equivalent, but instead of being coupled via wires it's coupled via RF. I think it feels like there's no return path and that the circuit is open, but it's a real circuit with complicated/uncommon coupling to the power source.

A resonator is both a component in the circuit (the case is a cavity resonator) and the type of circuit this is. When illuminated (or hooked up to a power supply on the bench), it produces a sine wave, and holding all else equal the frequency is a function of the capacitance of our membrane capacitor. That membrane is flapping about due to sound, changing the distance between the plates of our capacitor and thus it's capacitance. So this shifts the frequency we're resonating at and encodes the audio into our output signal (frequency modulation).

So it's very similar to a standard LC resonator circuit you might make on a breadboard.

I'll leave you with another story of clever KGB sabotage. The KGB controlled facilities used to construct the US embassy in Moscow in 1979. They were able to extensively bug the building. They were also able to mix thousands of diodes into the concrete. This defeated NLJD (https://en.wikipedia.org/wiki/Nonlinear_junction_detector) based bug detection because they detected the diodes in every direction.

Thanks for the explanation and will look into NLJD, really need pictures, that bee is cool

The CIA…plug a set of regular headphones into a microphone jack, open a recording application and speak into the headphone speaker, you don’t need a 3 letter agency for that physics open secret.

I got this clone Apple lightning to 3.5mm headphone jack adaptor for iPhone, my mind was kinda blown when I found out it just uses the lightning for power and inside the plug is a tiny bluetooth device that stream music over the 3.5mm jack. The original adaptor doesnt work like this as far as i have considered.

Wouldn't you need to rewire the headphones? Headphones use a 3-pin TRS whereas a 4-pin TRRS plug is used when you add a microphone. Regardless if the 4-pin is CTIA or OMTP, it's generally only going to get shorted to ground if a 3-pin TRS plug is plugged into a 4-pin TRRS socket, or if a 4-pin TRRS plug is plugged into a 3-pin TRS socket.

Diagram: https://i.sstatic.net/8rSD2.jpg

"Wouldn't you need to rewire the headphones?"

This is basic physics controlling the effect here, not electrical routing. Speakers are microphones by their very design. To make them work as a microphone, you merely speak into them with them plugged into an input jack that provides at minimum a line level electrical signal to be modified by wiggling the speaker cone/diaphragm back and forth.

Yes, but the computer doesn't have the firmware to "record" that signal from the speaker output pins. Thus, to record from the speakers acting like microphones, would require rewiring the headphone cable, for the vast majority of computing devices.

If you click "record" on your computer, there's no way to tell it to record signal from the speaker output channels, even if you write a custom low-level application directly making OS calls. The OS can't even do it, because it's not supported by the firmware.

"Yes, but the computer doesn't have the firmware to "record" that signal from the speaker output pins."

No, you plug directly into the microphone jack, that is what is providing your line level reference signal that gets changed by motion in the diaphragm. Zero rewiring required.

None of my 8 computing devices have that port.

Non-phone non-Apple devices often have a TRS microphone input separate from the TRS headphone output.

I am crap with physics but was going to say I think the last 50+ years of speaker development has been about making them less a microphone than they inherently are.

No, not really.

Dynamic loudspeakers and dynamic microphones are the same thing. They always have been the same.

They've got the knobs for the design variables turned in different directions, but they're still the same.

They even have the same frequency response whether they're being used as speakers or microphones at the moment.

Which brings up a valid way to measure the response of a microphone's design:

Use two of them. One as a speaker, and the other as a microphone. Play measurement-sounds out of one, and record the results on the other. Plot it out.

The deviations are magnified, but eliminating that magnification is just a math problem -- not an instrumentation problem. :)

They transmit sound. Anything able to detect the vibrations make it a microphone. Not sure how a speaker gets around that because it’s job is to vibrate.

The accelerometers that protect the average hard drive are easily subverted for this purpose.

There is something better. The little sensor that maintains the distance between the spinning platter and the armature is sensitive enough to be a reasonable microphone. But it is inside a heavy metal box (the HDD) so you do need to shout at it.

https://physics.aps.org/articles/v12/24

>> They tapped into the feedback system that helps control the position of the read head above the magnetic disk. When the head is buffeted by sound waves, the vibrations are reflected in the voltage signal produced by the drive’s position sensors. By reading this signal, Fu and his colleagues were able to make high-quality recordings of people speaking near the drive.

Good old video of a guy shouting in a data center https://youtu.be/tDacjrSCeq4?si=ebFDFYufOdNIU9av

The NSA could turn on your flip phones mic thirty years ago without you knowing, I don’t think they needed to do all that fancy stuff with hard drives. That’s just research that they funded to cover up the fact that they owned every computing device on the planet for a while.

I mean at this point I'm going to assume that any semiconductor device with more than a few pins has an embedded mems microphone.

it's not (just) the CIA, it's (just) physics

I don't think that's realistic. If you're looking at the acceleration sound waves cause against a phone's accelerometer, that's likely far below the sensitivity of the sensor- phones are too massive relative to the force of sound waves from speaking. F=ma, so the acceleration you're looking at is the force of the soundwave (tiny) divided by the phone's mass (relatively large). The only reason this kind of works is because you're putting the phone on an object that's mechanically vibrating. I suppose it would work in certain situations like putting the phone on top of a large speaker, but you'd never get the resolution to decipher audio from sound waves alone for a phone sitting on a desk or in a pocket

Sounds like you've got a great idea for a proof of concept for DefCon next year...

Probably worth reviewing prior art for inspiration:

0) https://www.usenix.org/conference/usenixsecurity14/technical...

1) https://infocondb.org/con/black-hat/black-hat-europe-2014/gy...

Sounds salty. https://people.csail.mit.edu/mrub/papers/VisualMic_SIGGRAPH2... use a potato chip bag as a microphone

This is why grapheneos creates 'sensors' as a permission. On android all apps can spy on you this way.

I doubt the sampling rate is anywhere near what you would need to make out dialog in a sound recording. You might be able to tell who is speaking though if you had a voice profile.

Reply on news.ycombinator.com