Eavesdropping Using Smart Phone Gyroscopes
The gyroscopes are sensitive enough to pick up acoustic vibrations. It’s crude, but it works. Paper. Wired article. Hacker News thread.
Comments
sioban • August 26, 2014 7:20 AM
Except that permissions to read Gyroscope data are not the same than reading sms or listening on mic.
Even worse, I think I’ve read somewhere that there’s no permissions at all for gyroscope data.
sioban • August 26, 2014 7:22 AM
Simply in the mentioned paper :
“Since iOS and Android require no special per-
missions to access the gyro, our results show that apps
and active web content that cannot access the micro-
phone can nevertheless eavesdrop on speech in the vicin-
ity of the phone”
nonnee • August 26, 2014 9:09 AM
@ SoWhatDidYouExpect
So, would you like to download and install this small app I’ve made? Please, read the disclaimer carefully, you’ll see that I’ll only be able to make internet connections, but hey, this app is kind of a RSS feeder, it needs to make connections.
And of course my app works better when you leave the phone over your desk, because you’ll need to see when the [name-some-display-feature] signs there is some update.
Ahhhh, and don’t even mind what you speak near your phone, please. Just make sure to speak loud and paused. And your male voice is so sexy, try to keep a low pitch.
Thanks!!!!
Name (required) • August 26, 2014 10:39 AM
The first link, https://crypto.stanford.edu/gyrophone/ (under “sensitive enough”), returned
“This Connection is Untrusted”
Maybe some braver/smarter soul wants to paste the article into a comment? I don’t. I don’t even know what that warning means OR implies – I’m just a normal person, not a cryptography expert, or even semi-expert. Am I supposed to be safe b/c the domain is stanford.edu, not stanford.ru?
Anyone? Please, and of course, thanks? Asking for advice from someone who knows better. The web is happy to tell me how to ignore the error message, but not whether or not I SHOULD. Which to me is just highly concentrated botheration!
Name (required) • August 26, 2014 10:47 AM
@SoWhatDidYouExpect? – The frequency of changes in the signal will reliably differentiate between sound and large-scale ‘movement’. [As confessed in comment above, my weakness is crypto, not everything else.]
Mike • August 26, 2014 5:04 PM
@Name(required): That is the result of a certificate for TLS which does not match the parameters of the site (domain name, issuer, etc.), whose validity cannot be established, or which has expired.
Harry Johnston • August 26, 2014 8:30 PM
@SoWhatDidYouExpect: the threat, as I read it, isn’t from the “snoops” (by which I assume you mean law enforcement / spy agencies) but rather from criminal organizations. (Not that smaller, less well-equipped governments might not take advantage of it too.)
Name (required), the “This Connection is Untrusted” thing is firefox’s total freak out way of alerting you to an invalid certificate.
If you use a Chromium-based browser (chrome, iron, etc), the reaction is much more measured. Basically, it loads the site, but makes it clear that you should not be trusting the https-ness of it by listing the address with a big red strike-through of the https portion of the address.
Problem with firefox’s reaction is that it will not display a site without you adding the cert to your list, which means you have to claim to trust the untrusted cert to see the site. Chromium just says, “here’s the site, don’t trust it when it claims https.”
RonK • August 31, 2014 11:35 PM
@ Me
Problem with firefox’s reaction is that it will not display a site without
you adding the cert to your list,
You do realize that this can be done on a temporary, one-time basis, right?
div • September 2, 2014 2:35 PM
@RonK
You do realize that this can be done on a temporary, one-time basis, right?
And for some unfathomable reason that is harder then accepting it permanently…
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
SoWhatDidYouExpect? • August 26, 2014 7:05 AM
On the surface, this seems absurd. When the snoops already have your voice data, texting data, SMS data, and internet activity, why would they resort to using a methodology that is less accurate and probably unstable? Isn’t this really the same as picking up voice through the vibrations given off by glass windows from the interior of a structure? And, one is typically walking, moving about, often changing positions of the gyroscope enabled device, which it seems would interfere with attmpts to “record” voice activity, especially if that device is also within vibration distance of radio, TV, other people speaking, normal environmental sounds, or just plain movement vibrations while the device is being carried around.
I call this FUD, like many other “announced” methodologies that seemingly attempt to identify a “perp”.