Eavesdropping on Sound Using Variations in Light Bulbs

New research is able to recover sound waves in a room by observing minute changes in the room’s light bulbs. This technique works from a distance, even from a building across the street through a window.

Details:

In an experiment using three different telescopes with different lens diameters from a distance of 25 meters (a little over 82 feet) the researchers were successfully able to capture sound being played in a remote room, including The Beatles’ Let It Be, which was distinguishable enough for Shazam to recognize it, and a speech from President Trump that Google’s speech recognition API could successfully transcribe. With more powerful telescopes and a more sensitive analog-to-digital converter, the researchers believe the eavesdropping distances could be even greater.

It’s not expensive: less than $1,000 worth of equipment is required. And unlike other techniques like bouncing a laser off the window and measuring the vibrations, it’s completely passive.

News articles.

Tags: academic papers, eavesdropping, side-channel attacks

Posted on June 16, 2020 at 10:20 AM • 12 Comments

Comments

Jeff Hall • June 16, 2020 12:56 PM

Works only with glass bulbs. Most indoor LED bulbs these days have a plastic covering so I doubt it will be as effective.

Norio • June 16, 2020 1:03 PM

I hate to say it, but this is not the first time someone has made light of a speech by President Trump.

Bruce Perry • June 16, 2020 1:03 PM

OT but why is no one discussing how Security Theater became standard all over America not just in airports which is large part of protests we are seeing today? AND Has the TSA been innocent of the kind of profiling and violence we have seen on our streets? Just two topics for discussion whenever. BP

Thunderbird • June 16, 2020 1:52 PM

Works only with glass bulbs. Most indoor LED bulbs these days have a plastic covering so I doubt it will be as effective.

They describe three setups in the paper. The first uses an unilluminated bulb with a sensor attached. The other two

From the paper:

Experimental Setup: We directed a telescope at a hanging
12 watt E27 LED bulb (as can be seen in Figure 6).

and

Fig. 13. Experimental setup: The distance between the eavesdropper (located on a pedestrian bridge) to the hanging LED bulb (in an office on the third floor
of a nearby building) is 25 meters.

In neither case did they state that there had to be a glass bulb. Do you have an source of information in addition to the paper?

Clive Robinson • June 16, 2020 2:08 PM

@ ALL,

@David Rudling linked to a “Wired” Article on the Friday squid, and my reply answers some questions that have been raised.

From the Wired article it’s about an apparently fairly simple twist on a basically old technique. Which does not supprise me when I read in the article,

“Researchers from Israeli’s Ben-Gurion University of the Negev and the Weizmann Institute of Science”

It’s the usual suspects for “reboiling cabbage” 😉

As for how old the idea is…

Basically what is happening is that sound is getting superimposed onto a light source by some cross modulation method. Think about an Aldis Lamp or heliograph[1]for sending morse code between military units and ships at sea, which is good for upto 15 nautical miles (~27km or 17miles) at sea and further from hill tops on land.

Or if you want to go even further back waving of tourches several millennia ago that gave rise to what many call a Polybius square[2].

Any way as for the telescope for picking up light, if you have a look on the UK Cambridge Computer Labs Lightbluetouchpaper.org web site you will find that quite some time ago they used that and a photomultiplier to read the changes of light intensity off of a wall caused by the “flying spot” of a Cathode Ray Tube (CRT) computer screen as a modified type of Van Eck Phreeking.

So most of the idea is “borrowed” from others, which is normall for this group of researchers.

As for the “novel” part if you can call it that. From the article they talk about “hanging lamps” without mentioning shades or reflectors, but go on to say,

“LED bulbs also offer a signal-to-noise ratio that’s about 6.3 times that of an incandescent bulb and 70 times a fluorescent one.”

This suggests that it’s not the vibration of the glass, but the vibration of the light source such as the filament, and thus it’s actually the entire bulb moving.

Which brings into consideration the mass of the bulb. Because as with a pendulum the mass on the end of the link from the pivot effects the frequency response especially anything near resonance or a multiple where the swinging will in effect increasingly store energy…

Anyway, yes it’s new in “academic papers” but actually it’s just a variation on Optical TEMPEST techniques, which is a small subset of passive EmSec techniques going back to the 1980’s or earlier one way or another.

It’s reasonably certain that GCHQ and the NSA were aware of it at least as far back as the 1980’s from the release of “redacted documents” under FOI etc. Most things were not redacted thus confirming what was well known at the time about electrical energy. However there was not mention of items relating to “mechanical vibration” conduction and radiation such as acoustics and seismology and their spin offs. Thus we might find out that those redacted areas were about various forms of mechanical energy.

However if nothing else this paper reinforces the point I make about “energy gaps” rather than “air gaps” because this is most definitely an “air gap” crossing technique that transports information impressed on mechanical vibrations over a considerable “air gap” and very probably works around corners and even from down corridors.

[1] http://www.telegraph-office.com/pages/Black-Watch-Signal-Unit.html

[2] The Polybius square is actually a simple device that was invented by “Cleoxenus and Democleitus” who were a couple of Ancient Greeks for military signalling. As with other ciphers (playfair) the name that became attached to it was the name of the person who publicized it not who invented it. In this case the famous Ancient Greek scholar Polybius.

MarkH • June 16, 2020 5:34 PM

@Bruce Perry:

You raised interesting questions about the Transportation Security Administration (TSA) which I haven’t seen asked before.

Has the TSA been innocent of the kind of profiling and violence we have seen on our streets?

I haven’t seen answers to either, but I suspect that forceful violence has not been much of a problem, because otherwise it would be showing in the headlines from time to time.

My thoughts and speculations, for what they’re worth:

• The role of TSA is more like private security guards, than badged police officers.

• Training is (if I understand correctly) only two weeks, and probably very different from police training. I presume that it doesn’t emphasize pursuits, takedowns, arrest and the the like. Part of the cancer in U.S. policing is the doctrine of control – dominance – intimidation – threat – application of force – escalation to deadly force.

• New police officers are probably more influenced by their veteran colleagues than by their training. I speculate that this “follow the alpha dog” dynamic is stronger in male-only groups common in law enforcement. TSA has a high proportion of women, and operate under different stressors, so I speculate that imitating the elders is less potent. This effect for police officers is very important, because no matter what they learn in police school, if their experienced colleagues are telling them “you’ve got to break a few heads out there,” that’s what most of the new cops will do.

• In my region, a high proportion of TSA officers are black¹. This is surely not a guarantee against racial profiling, but probably reduces it. Also, international airports have such a profusion of ethnicities and languages among the travelers that the typical “black/white” dichotomy of many U.S. cities doesn’t apply.

There are abundant grounds for criticizing TSA. Slaughtering people doesn’t seem to be one of them.

¹ On the train in JFK airport, I sat across from 4 or 5 uniformed TSA officers, all young black women. To make a little joke with them, I said “I feel safe with you here!” To which one of them answered, “Our shift is over — you on yo’ own!”

Drone • June 16, 2020 7:50 PM

Just add this to all the other things that are constantly spying on me and/or tracking me without my consent: 1. Mobile phone, 2. Car navigation, 3. Google Echo, 4. Amazon Alexa, 5. “Smart” TV, 6. “Smart” watch, 7. Credit cards, 8. ATM cards & banks, 9. Web browser, 10. Any sort of messaging or social media app or service, 11. Health care system & insurance.

David • June 16, 2020 8:19 PM

The LED bulb might work better than the filament type because the LED current is DC. The sniffer will be using an AC coupled amplifier, so the filament bulb will have a dirty 50Hz signal sitting on it.
Some brands of LED bulbs are going to have microphonic power supplies as well – robust construction is not part of the design spec

David • June 17, 2020 6:06 AM

@drone

Just add this to all the other things that are constantly spying on me and/or tracking me

The bulb is a manual, targeted spying technique that requires an adversary taking a specific interest in you. The others you mentioned automatically track everyone indiscriminately. The difference means, don’t worry about the bulb technique. Or buy thick curtains.

Jimbo • June 17, 2020 11:12 AM

Not much of a risk in real life. Why would anyone have secure or even private meetings in a room with windows? Having worked in the military and for a large defense contractor, I can assure you that their conference rooms do not have windows or desk phones as even basic security.

Henry877 • June 18, 2020 4:26 PM

@MarkH

[TSA] Training is (if I understand correctly) only two weeks, and probably very different from police training.

TSA training is focused almost exclusively on identifying the different x-ray shapes inside luggage that may indicate potential threats. TSA is rated/tested/monitored on what percent of contraband they let through, and gets many bad headlines for how poorly they do on these tests.

Anyway, it makes perfect sense that they train to their test.

Eric S. Harris • July 18, 2020 8:31 AM

On a recent trip, my traveling companion went to complain about damage to one of his items, and to try to get compensation. (He succeeded eventually, but it took an unreasonable amount of persistence and assertiveness.)

While he was waiting for his ordeal, the baggage claim people were dealing with another customer’s more serious complaint. Apparently their luggage had been opened, jewelry and other items taken, and clothes from someone else’s luggage was stuffed into their bag. IIRC, their luggage had taken a side trip before eventually arriving at the airport.

Another theft by TSA? Or the airline’s baggage handler? Someone else with access to luggage? Or was it a scam by the traveler? That last possibility seems unlikely.

Schneier on Security

Eavesdropping on Sound Using Variations in Light Bulbs

Comments

Leave a comment Cancel reply