Real-Time Passive Sound Recovery from Light Bulb Vibrations
Recent studies have suggested various side-channel attacks for eavesdropping sound by analyzing the side effects of sound waves on nearby objects (e.g., a bag of chips and window) and devices (e.g., motion sensors). These methods pose a great threat to privacy, however they are limited in one of the following ways: they (1) cannot be applied in real time (e.g., Visual Microphone), (2) are not external, requiring the attacker to compromise a device with malware (e.g., Gyrophone), or (3) are not passive, requiring the attacker to direct a laser beam at an object (e.g., laser microphone).
In this paper, we introduce "Lamphone," a novel side-channel attack for eavesdropping sound; this attack is performed by using a remote electro-optical sensor to analyze a hanging light bulb's frequency response to sound.We show how fluctuations in the air pressure on the surface of the hanging bulb (in response to sound), which cause the bulb to vibrate very slightly (a millidegree vibration), can be exploited by eavesdroppers to recover speech and singing, passively, externally, and in real time.We analyze a hanging bulb's response to sound via an electro-optical sensor and learn how to isolate the audio signal from the optical signal. Based on our analysis, we develop an algorithm to recover sound from the optical measurements obtained from the vibrations of a light bulb and captured by the electro-optical sensor. We evaluate Lamphone's performance in a realistic setup and show that Lamphone can be used by eavesdroppers to recover human speech (which can be accurately identified by the Google Cloud Speech API) and singing (which can be accurately identified by Shazam and SoundHound) from a bridge located 25 meters away from the target room containing the hanging light bulb.
The sound snd(t) from the victim's room (1) creates fluctuations on the surface of the hanging bulb (the diaphragm) (2). The eavesdropper directs an electro-optical sensor (the transducer) at the hanging bulb via a telescope (3). The optical signal opt(t) is sampled from the electro-optical sensor via an ADC (4) and processed to a recovered acoustic signal snd*(t) (5).
We tested the performance of Lamphone attack in terms of its ability to recover speech and songs from a target location when the eavesdropper is not at the same location.
The target location was an office located on the third floor of an office building. Curtain walls, which reduce the amount of light emitted from the offices, cover the entire building. The target office contains a hanging E27 LED bulb (12 watt).
The eavesdropper was located on a pedestrian bridge, positioned an aerial distance of 25 meters from the target office. The experiments described in this section were performed using three telescopes with different lens diameters (10, 20, 35 cm). We mounted an electro-optical sensor (the Thorlabs PDA100A2, which is an amplified switchable gain light sensor that consists of a photodiode that is used to convert light to electrical voltage) to one telescope at a time. The voltage was obtained from the electro-optical sensor via a 16-bit ADC NI-9223 card and was processed in LabVIEW script that we wrote. The sound that was played in the office during the experiments could not be heard at the eavesdropper’s location
We placed three telescopes with different lens diameters (10, 20, 35 cm) on the bridge. The SNR that was obtained from the optical measurements obtained from each telescope and the acoustical measurements obtained from the microphone is presented in the next graph. Based on the results obtained we created an equalizer.
Sound Recovered From A Hanging Bulb
We recovered two songs and one sentence that were played via speakers in the office using optical measurements that were obtained from a single telescope.
Hear the recovered audio:
Ben Nassi at BlackHat USA 2020