Despite the fact that the Internet of Things has gained momentum, the old light bulbs can still become our “enemy” at home: any light bulb in a room that is visible from the window can be used to spy on our conversations from afar. An experiment has attested to this.
This new hacking technique has allowed a team of researchers to discern the sound, including the song “Let it Be” by the Beatles, “Clocks” by Coldplay and the audio of a Donald Trump speech that was playing on television, from of … the vibrations of the light bulbs. This is a creative way to spy on conversations.
How is it possible?
This new form of espionage, called “Lamphone” , is carried out by analyzing the small vibrations of a light bulb, caused by nearby sounds. This is possible because human voices are essentially sound waves and cause all kinds of vibrations that are invisible to the naked eye, but with the right equipment …
All an attacker would need is a laptop, a telescope, and an electro-optical sensor. And, of course, not be too far from the window of a room that contains a light bulb hanging from a lamp. The pendant bulb acts as both a diaphragm and a transducer. Apparently these two sound waves cascade onto its surface and convert the air pressure of sound to small changes in light, which means it is a useful device for intruders.
“ Fluctuations in air pressure on the surface of the hanging light bulb (in response to sound), which cause the light bulb to vibrate very slightly (a vibration of one millimeter), can be exploited by listeners to retrieve speech or speech. music, externally and in real time, ”said the researchers from Ben-Gurion University of the Negev and the Weizmann Institute of Sciences whose work will be presented at the Black Hat USA 2020 virtual conference in August.
The researchers tested the trick by placing multiple telescopes about 25 meters away from the bulb in a target office (with lens diameters of 10, 20 and 35 centimeters). They then used a Thorlabs PDA100A2 electro-optical sensor attached to the telescope’s eyepiece. The target bulb was a 12 watt LED bulb.
The lightbulb in the room emitted small vibrations in reaction to sound, including, for example, music on the radio or someone speaking. These vibrations were reflected in the light signals captured by the electro-optical sensor. The experts then used an analog-to-digital converter and transformed the electrical signals from that sensor into digital information. Finally, the researchers processed the signals through software to filter the noise , using the Google Cloud Speech API to retrieve human speech and applications like Shazam or SoundHound to identify songs.
According to security researchers, even though the hack was done around 100 feet from the target bulb, this technique could be amplified with the right equipment.
We spoke with cybersecurity expert Deepak Daswani (The Hacker Menace, 2018) to dig a little deeper into this issue.
It is an experiment, but what is the most dangerous or worrying thing about this Lamphone technique?
“The most worrying or dangerous thing is still something that we already know and that constitutes the basis of this digital society that we live in. What is safe today may not be safe tomorrow. And there will always be new threats or ways of trying to compromise the security of users and organizations. In this case, perhaps the most relevant thing is that there is no technological device to compromise such as a computer, a mobile device, a television, or any gadget that belongs to the IoT. Nor does it compromise by exploiting any vulnerability or installing malware. It is a different attack, from what is known in the security world as Side channels in air-gapped environments (isolated by the air). On the other hand, it is a really ingenious and sophisticated technique, which also requires certain conditions such as being at a relative distance from the victim, in addition to having the necessary equipment and technical knowledge. It is not something trivial ”.
Would all types of light bulbs be sensitive to cyber espionage?
“For now the system has been tested with a pendant light. At the moment it is not clear if a light bulb inside a lamp or a fixed one in the ceiling would have the same effect. On the other hand, the recordings of Trump and the Coldplay song with which the researchers have carried out the experiment are at a volume higher than that of a human conversation. But on the contrary, it is claimed that they used a very cheap sensor and DAC, and that by improving the equipment, quieter conversations could be obtained. Probably not all bulbs are sensitive and require certain conditions. We will have to wait to see how the research evolves in this regard ”.
At this rate, are we going to have to say goodbye to privacy?
“In the world we live in, privacy is a highly coveted commodity . We have already seen throughout history many attempts to invade the privacy of users in different ways. Not only by cybercriminals, governments or states, but also by the tech giants that make wonderful technology and functionality available to users in exchange for privacy. In a way, users assume in many cases that in exchange for the use of these services for free they must provide their data. And in many cases they also give them voluntarily through compulsive publications on social networks. There will always be ways anyway to try to preserve our privacy as much as possible as far as possible . “
How can we protect ourselves from such creative espionage as this?
“For this specific case, it would be enough to isolate the room where we are having that conversation so that no one could spy or have visibility of the light bulb. Closing doors and windows would be enough, as well as covering the bulb with some insulating material, or simply turning off the light and having a conversation in the dark. It is more intimate and romantic ”.
Are there other ways to hack our devices without intrusion in the traditional style? (such as Gyrophone or Visual Microphone)
“These types of attacks are not new. The use of vibrations to obtain information dates back to World War I (with telephone wires) and later to the Cold War with more advanced technology. In addition to the ones you comment on, we have seen these types of attacks for many years. Longitudinal sound waves are produced as a consequence of a periodic disturbance in the air. The sound body can vibrate longitudinally or transversely. With what any vibrating medium is capable of acting as a repeater, it depends on the absorption capacity of the material. For many years, we have known about TEMPEST attacks that focus on these types of environments, such as the one carried out in 2009 by Andreas Bogk at the Chaos Computer Club or the one in 2016 by Daniel Genkin and his colleagues at Tel Aviv University ”.
This video shows the Lamphone proof of concept.
Referencia: Lamphone: Real-Time Passive Sound Recoveryfrom Light Bulb VibrationsBen Nassi,1Yaron Pirutin,1Adi Shamir,2Yuval Elovici,1Boris Zadov11Ben-Gurion University of the Negev,2Weizmann Institute of Science{nassib, yaronpir, elovici, zadov}@bgu.ac.il, [email protected] -https://www.nassiben.com/lamphone
