Acoustic Eavesdropping through Wireless Vibrometry University of Wisconsin – Madison, Chinese Academy of Sciences School of Electronic Information and Electrical Engineering Presenter: XiaofengHou Student ID:

The Evolution of Acoustic Eavesdropping Directional Microphone Fail in the sound-proof environment. Widely used in espionage and newsgathering Laser-based Microphone Highly directional and sensitive. Require unobstructed line-of-sight between the subject and laser. Microwave-based Microphone Penetrate sound-proof material and unblocked by obstacles The basic idea of this paper lies in a translation between acoustic vibration and radio signal fluctuation.

Initial Questions ? Q1 ： How to capture acoustic information by radio signal fluctuation ？ Q2 ： How to recover the primitive sound from signal fluctuation ？ Q3 ： How to boost the eavesdropping quality ？ Q4 ： How to defend against the eavesdropping ？ Q5 ： ……

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Acoustic Eavesdropping through Wireless Loudspeaker and Wi-Fi are widely used in the conference and home environment Image wireless can pick up the sound and leak private information

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Threat Model Translate acoustic vibration into radio signal fluctuation Step 1 ： Audio emission causes small vibration of the loudspeaker body, which is invisible to human eyes. Step 2 ： But such minute motion can resonance with radio waves reflected by the loudspeaker, or originating from a wireless transmitter co-located with the loudspeaker. Step 3 ： The contaminated radio waves can be captured by a tampered receiver and processed to recover the original audio played by the loudspeaker.

Threat Models EmissiveReflective Attacker Tx Rx Victim Wall Attacker Victim Wall Rx AP Compared to the right, the left can control radio signal into a specific frequency band, with a practical transmit power level. What’s the natural difference between reflective and emissive vibrometry ?

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Taylor expansion Acoustic-Radio Transformation Problem & Challenge Q2 ： How to recover the primitive sound from signal fluctuation ？ Radio pathloss Acoustic-Radio Transformation (ART) RSS-based ART Phase-based ART DC component Audio signal component High-order harmonics DC component Audio signal component Micro Doppler

Observations & Solutions Enhance the eavesdropping quality Problem & challenge Challenge 1 ： Noises, i.e. reflections from irrelevant background objects can overwhelm the signals modulated by the loudspeaker. Q3 ： How to boost the eavesdropping quality ？ Challenge 2 ： The reflected signals is orders of magnitude lower than sub- millimeter and become weaker as attacker-victim distance d0 increases beyond a few meters. Solution 1 ： A simple frequency filter. Observation 1 ： The leakage and background signals are typically quasi- stationary compared to the audio vibration. Solution 2 ： Multi-antenna beamforming. Observation 2 ： The radio sampling rate is far beyond the audio frequency.

Bandpass filter TxRx Loudspeaker reflection Received signal Background Reflection Path Loudspeaker Reflection Path Wireless signal is broadcasting in natural I Q SlSl S ScSc Background reflection Background reflections Multipath affects eavesdropping quality

Blind multi-antenna beamforming I Q SlSl S ScSc I Q SlSl S ScSc I Q SlSl S ScSc Antenna 1Antenna 2Beamform Basic Idea Solution: blind beamforming algorithm Problem: no channel training Weight Searching RxTx Radio 1 Radio 2 TxRx Radio 1 Radio 2 RxTx Radio 1 Radio 2 Role-switch Rx weight search 2 Blind multi- antenna Beamforming Rx weight search 1 Improved eavesdropping quality

Observations & Solutions Enhanced Emissive ART Problem & challenge Q ： How to distinguish the victim’s reflection from various noises ？ Challenge ： Compared to the reflective ART, which transfer radio signal with specified frequency, the missive one can’t control the wireless signal, i.e. WiFi. Attacker Rx AP STFLTFHeaderPayload Short Training Field (STF) Packet detection Emissive ART

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Experiment Setup Conference Room Sound-proof Room Diversity gain Distance to antenna: 1 ~ 5m

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Counter Measure #2 ： Interfering Mechanical Vibrations Human movement Rotating fan … Uplink WiFi packets time Original power of packets Power time Randomized power of packets Power #3 ： Transmission Power Randomization #1 ： Safety Distance Mainly dependent on the audio’s PSNR

Contents Background and Motivation Threat Model Implementation Methodologies Reflective Audio Eavesdropping Emission Audio Eavesdropping Set & Experiment Counter Measures Conclusion

Answers to the initial questions Q1 ： How to capture acoustic information by radio signal fluctuation ？ S1 ： Translate acoustic vibration into radio signal fluctuation. Q2 ： How to recover the primitive sound from signal fluctuation ？ S2 ： Acoustic-Radio Transformation (ART). Q3 ： How to boost the eavesdropping quality ？ S3 ： A simple frequency filter, multi-antenna beamforming. Q4 ： How to defend against the eavesdropping ？ S4 ： Interfering mechanical vibrations, transmission power randomization. Q5 ： …… Future work ： Investigation into the effect of WIFI packet rate to eavesdropping quality, more detailed counter measures, ……