Author Topic: Researchers find microphones are susceptible to light-based signal injection  (Read 906 times)

0 Members and 1 Guest are viewing this topic.

Offline rfeecs

  • Frequent Contributor
  • **
  • Posts: 694
  • Country: us
https://lightcommands.com/

The paper:
https://lightcommands.com/20191104-Light-Commands.pdf

Pretty amazing.  Alexa can be hacked with a laser pointer.

Quote
We propose a new class of signal injection attacks
on microphones based on the photoacoustic effect: converting
light to sound using a microphone. We show how an attacker
can inject arbitrary audio signals to the target microphone
by aiming an amplitude-modulated light at the microphone’s
aperture. We then proceed to show how this effect leads to
a remote voice-command injection attack on voice-controllable
systems. Examining various products that use Amazon’s Alexa,
Apple’s Siri, Facebook’s Portal, and Google Assistant, we show
how to use light to obtain full control over these devices at
distances up to 110 meters and from two separate buildings.
« Last Edit: November 05, 2019, 08:30:32 pm by rfeecs »
 
The following users thanked this post: RoGeorge, I wanted a rude username

Offline Kleinstein

  • Super Contributor
  • ***
  • Posts: 7749
  • Country: de
It is a cool idea, but photo-acoustic  tends to be rather low amplitude, especially at higher frequencies. So the Laser would need to be quite high in power. From distant memory the sound was not that load even with a 5 mW laser.
 

Offline rfeecs

  • Frequent Contributor
  • **
  • Posts: 694
  • Country: us
They tried 5mW and 60mW lasers.  Both worked with different devices depending on range.

They also indicate that this is a problem specifically with MEMs microphones.

I wonder how it works?  They claim it is causing mechanical movement of the microphone membrane, not some electrical effect.  I guess it is thermal heating of the air near the membrane?
 

Offline Kleinstein

  • Super Contributor
  • ***
  • Posts: 7749
  • Country: de
The classic photo-acoustic is heating some material (solid, but also gas) with light and the heat than via thermal expansion (for solid usually by conduction to a gas layer) causes sound. This was a microphone can be used to detect the AC part of temperature, especially surface temperature.

Some microphones may have an extra effect from light entering the microphone and acting like a photodiode inside.
 

Offline imo

  • Super Contributor
  • ***
  • Posts: 2650
  • Country: 00
Some microphones may have an extra effect from light entering the microphone and acting like a photodiode inside.
I bet this is the actual source of trouble. The MEMS microphones have a hole directly to the chip, which is of course extremely sensitive to any light.
Try with a dynamic microphone and your laser injection will be busted :)
 

Offline Kleinstein

  • Super Contributor
  • ***
  • Posts: 7749
  • Country: de
For cost reasons those units would use electret- or maybe MEMS microphones.  electret microphones may also show some internal (e.g. bolometer like) effect. In any case there would be the classical photo-acoustic: producing real sound via a thermal effect. It may be weak and need considerable power (e.g. 10s of mW), but no easy way to stop it.

So better add a mechanical switch to active the acoustic control  :-DD.
 

Offline RoGeorge

  • Super Contributor
  • ***
  • Posts: 2481
  • Country: ro
Drunk Superman will love this!   ;D
« Last Edit: November 07, 2019, 10:05:12 am by RoGeorge »
 

Offline larrybl

  • Regular Contributor
  • *
  • Posts: 121
  • Country: us
Smarter every day has a recent video about this.
 
The following users thanked this post: SeanB

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3299
  • Country: 00
  • STM32, STM8, AVR, 8051
I very strongly doubt this can work, with a 5mW laser at 100m distance.

If I would just have any kind of laser at home, I'd try right away.

Strongly doubt any effect on an electret and dynamic mikes.   

Not sure about MEMS, but the effect would also be likely pretty small.
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 15408
  • Country: za
Electret will be affected, as there is a very high impedance electrode inside that is right behind the membrane, which is the gate junction of the JFET transistor used inside it. Basically a low capacitance diode junction in a very tiny epoxy package, and there probably will be enough light penetration into the junction to make it leak more. Not much, but as there is a 1G resistor to leak current away not much is needed, and there is always a lot of gain after it as well.
 

Offline JohnG

  • Frequent Contributor
  • **
  • Posts: 269
  • Country: us
It may that that thermal acoustic power is enough.

If 1% of the lasers 5 mW is converted to absorbed acoustic power, we get 50 uW, which would amount to about 77 dB effective SPL at the microphone, which is fairly loud and would be easily picked up by a cheap microphone.

If 0.01% is converted, you are at 57 dB SPL, which is quiet, but still audible.

Feel free to poke holes at these numbers. It's been a long time since I studied anything acoustic.

Cheers,
John
"Those who learn the lessons of history are doomed to know when they are repeating the mistakes of the past." Putt's Law of History
 
The following users thanked this post: I wanted a rude username

Offline Kleinstein

  • Super Contributor
  • ***
  • Posts: 7749
  • Country: de
The thermal effect if very low efficiency, as the temperature rise is tiny and thus from the Carnot limit efficiency can not be high. So even the 0.01% sound like high. However the sound source can be very close to the microphone, especially when inside. So I don't think there is a simple conversion to SPL.

The electret inside a microphone can (and likely will) also show pyroelectric effect, not as good as the dedicated IR detectors, but here the laser power can be way higher than thermal IR radiation.
 

Offline JohnG

  • Frequent Contributor
  • **
  • Posts: 269
  • Country: us
Interesting, thanks. I had no idea what the thermal efficiency would be. Definitely my SPL calculations are not directly applicable, because the sensitivity specs for a microphone include the impedance mismatch between the air and the sensing element, which is usually large and thus will attenuate a conventional sound substantially. If heating the element directly, then this mismatch is avoided and the "effective" sensitivity will be higher. Unfortunately, I do not have a good idea what these numbers are.

I had not thought about the pyroelectric effect.

I wanted to put some numbers out to get an idea of what might be possible.

Cheers,
John
"Those who learn the lessons of history are doomed to know when they are repeating the mistakes of the past." Putt's Law of History
 

Offline ConKbot

  • Super Contributor
  • ***
  • Posts: 1181
I very strongly doubt this can work, with a 5mW laser at 100m distance.

If I would just have any kind of laser at home, I'd try right away.

Strongly doubt any effect on an electret and dynamic mikes.   

Not sure about MEMS, but the effect would also be likely pretty small.

A "practical" demonstration, along with some nice die shots of MEMS mics.
https://youtu.be/ozIKwGt38LQ

Shown working though a window, with a telescope as a focusing and alignment device. Not exactly laser-pointer+cell phone sound clips easy sort of level, but not exactly hard either.
 
The following users thanked this post: JohnG


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf