Chinese scientists find a way to hear headphone sound even from behind a wall
Chinese scientists have discovered a way to hear sound from headphones even through walls
Chinese researchers have developed a method to capture sound and other analog signals from ordinary electronics using electromagnetic influence. This method, called InjectEave, allows the recovery of sound from headphones from a distance of up to 30 meters, including through walls.
Unlike typical attacks carried out via electromagnetic side-channels, InjectEave does not simply attempt to capture the device's very weak radiation. Instead, a potential attacker transmits a radio signal of their own in the range of 0 to 9 MHz — the authors of the work did not disclose its exact parameters. Such a signal interacts with the non-linear electronic components of the device, causing the useful analog signal to leak in a form that can be recorded by receiving equipment.
"Our InjectEave project shows that radio frequency signals can cause information leakage from ordinary headphones, allowing an attacker to recover the broadcast sound from a distance of up to 30 meters, including through walls," says Yan Lun, an associate professor at the Hong Kong University of Science and Technology in Guangzhou.
The method works due to non-linear components that are found almost everywhere: amplifiers, analog-to-digital converters, power converters, and switching MOSFET transistors. The interaction of the injected radio signal with the electronics actually modulates the original signal — for example, the sound in the headphones — after which it becomes easier to detect from the outside.
The researchers tested InjectEave on 11 production devices. Among them were Sony ZX110AP and Apple Earbuds wired headphones, Ugreen MAX2, Philips TAH2020, and HP H231R wireless models, a Flyingvoice P23GW VoIP phone, OIDIRE ODI-MF10A and Xiaomi BPLDS10DM smart fans, as well as JINGZAO JDO-06 and Xiaomi 1S lamps.
For most of the tested devices, the maximum distance was about one to six meters, and the sound could be intercepted even through a wall. In a separate experiment conducted with an additional radio frequency amplifier, the researchers managed to recover clear sound from headphones from a distance of up to 30 meters. They also demonstrated scenarios where the equipment could be hidden in a suitcase next to a hotel room or installed inside office furniture.
Carrying out the attack does not require a specialized laboratory. The authors used a software-defined USRP B210 radio system, transmitting and receiving antennas, a Siglent SSA3075X Plus spectrum analyzer, and a laptop. The radio frequency amplifier is only needed to extend the range.
The scope of application is not limited to eavesdropping. According to the researchers, a similar method can be used to analyze the control signals and energy consumption of smart lamps and fans, thereby potentially detecting the movements of people in a room.
The risk of attack can be reduced through hardware means — shielding, filtering, and using twisted pair cabling. However, the researchers note that such measures only complicate the attacker's work and do not guarantee complete protection.