Using Light Bulb Vibrations to Eavesdrop
Using Light Bulb Vibrations to Eavesdrop
June 15, 2020
Wired — The list of sophisticated eavesdropping techniques has grown steadily over years: Wiretaps, hacked phones, bugs in the wall—even bouncing lasers off of a building’s glass to pick up conversations inside. Now add another tool for audio spies: Any light bulb in a room that might be visible from a window.
Researchers from BGU and the Weizmann Institute of Science recently revealed a new technique for long-distance real-time eavesdropping they call “lamphone.”
The lamphone allows anyone with a laptop and less than a thousand dollars of equipment—just a telescope and a $400 electro-optical sensor—to listen in on any sounds in a room that is hundreds of feet away in real time, simply by observing the miniscule vibrations those sounds create on the glass surface of a light bulb inside.
By measuring the tiny changes in light output from the bulb that those vibrations cause, the researchers show that a spy can pick up sound clearly enough to discern the contents of conversations or even recognize a piece of music.
BGU Ph.D. student Ben Nassi, member of the Cyber Security Research Center
“Any sound in the room can be recovered from the room with no requirement to hack anything and no device in the room,” says Ben Nassi, lead author and a Ph.D. student in BGU’s Department of Software and Information Systems Engineering and member of BGU’s Cyber Security Research Center, who developed the technique with fellow researchers Yaron Pirutin and Boris Zadov.
They plan to present their findings at the Black Hat security conference in August. “You just need line of sight to a hanging bulb, and this is it,” says Nassi.
In their experiments, researchers placed a series of telescopes around 80 feet away from a target office’s light bulb, and put each telescope’s eyepiece in front of a Thorlabs PDA100A2 electro-optical sensor.
They then used an analog-to-digital converter to convert the electrical signals from that sensor to digital information. While they played music and speech recordings in the faraway room, they fed the information picked up by their set-up to a laptop, which analyzed the readings.
The researchers found that the tiny vibrations of the light bulb in response to sound—movements that they measured at as little as a few hundred microns—registered as measurable changes in the light their sensor picked up through each telescope.
After processing the signal through software to filter out noise, they were able to reconstruct recordings of the sounds inside the room with remarkable fidelity.
They showed, for instance, that they could reproduce an audible snippet of a speech from President Donald Trump well enough for it to be transcribed by Google’s Cloud Speech API.
They also generated a recording of the Beatles’ “Let it Be” clear enough that the name-that-tune app Shazam could instantly recognize it.
The technique nonetheless has some limitations. In their tests, the researchers used a hanging bulb, and it’s not clear if a bulb mounted in a fixed lamp or a ceiling fixture would vibrate enough to derive the same sort of audio signal.
The voice and music recordings they used in their demonstrations were also louder than the average human conversation, with speakers turned to their maximum volume.
But the team points out that they also used a relatively cheap electro-optical sensor and analog-to-digital converter, and could have upgraded to a more expensive one to pick up quieter conversations.
LED bulbs also offer a signal-to-noise ratio that’s about 6.3 times that of an incandescent bulb and 70 times a fluorescent one.
Prof. Yuval Elovici , director of the Cyber Security Research Center and member of BGU’s Department of Software and Information Systems Engineering
The research team, which was advised by BGU’s Prof. Yuval Elovici and Adi Shamir, the co-inventor of the ubiquitous RSA encryption system, isn’t the first to show that unexpected sonic phenomena can enable eavesdropping.
The closest previous technique to lamphone is what MIT, Microsoft and Adobe researchers in 2014 called a “visual microphone”: By analyzing video recorded via telescope of an object in a room that picks up vibrations—a bag of potato chips or a houseplant, for instance—those researchers were able to reconstruct speech and music.
But Nassi points out that the video-based technique, while far more versatile since it doesn’t require a bulb to be visible in the room, requires analysis of the video with software after it’s recorded to convert the subtle vibrations observed in an object into the sounds it picked up.
By contrast, lamphone enables real-time spying. Since the vibrating object is itself a light source, the electro-optical sensor can pick up vibrations in far simpler visual data.
That could make lamphone significantly more practical for use in espionage than previous techniques, says Nassi. “When you actually use it in real time you can respond in real time rather than losing the opportunity,” he says.
The researchers are publishing their findings not to enable spies or law enforcement, but to make clear to those on both sides of surveillance what is possible. “We want to raise the awareness of this kind of attack vector,” says Nassi. “We’re not in the game of providing tools.”
Stories Like This
