New EM side-channel attack eavesdrops on headphones from 30 meters
Chinese researchers demonstrate active signal injection to bypass analog security
1Active EM injection breakthrough
Researchers at HKUST developed InjectEave, an active electromagnetic injection technique that modulates faint analog signals in consumer devices. Unlike passive eavesdropping methods, it overcomes signal-to-noise ratio limitations by actively injecting 0-9 MHz RF signals. The method successfully targeted 11 commercial devices including headphones from Sony, HP, and Philips. This represents a significant advancement in side-channel attacks, moving beyond traditional passive monitoring approaches to active signal manipulation.
230-meter eavesdropping range
The team demonstrated audio recovery from headphones up to 30 meters away, including through walls. Typical attack ranges were 1-6 meters without amplification, sufficient for surveillance through hotel walls or from concealed equipment in office furniture. Tests used commodity hardware: a USRP B210 software-defined radio, spectrum analyzer, and optional RF amplifier. The maximum range was achieved with wireless headphones, though wired models and smart home devices were also vulnerable. This range dramatically expands potential espionage scenarios compared to previous side-channel techniques.
3Targeting hardware nonlinearities
InjectEave exploits nonlinear components common in computer systems - amplifiers, ADCs, power converters, and MOSFETs. The injected RF signal interacts with these components to modulate target audio signals, making them detectable. This approach bypasses digital security measures entirely, as the leakage occurs in analog pathways before any encryption. The researchers note this vulnerability is fundamental to how modern electronics process signals, making it widespread across device types and manufacturers.
4Tested device vulnerabilities
Successful attacks were demonstrated on Sony ZX110AP and Apple Earbuds (wired), UGreen MAX2 and HP H231R (wireless), Flyingvoice P23GW VoIP phone, and smart devices from Xiaomi and others. The diversity of affected devices shows the attack's broad applicability. Smart home devices revealed additional risks - control signals and power consumption patterns could expose personal activities. All tested devices leaked information when subjected to the injection attack, regardless of their digital security features.
5Practical attack scenarios
Researchers documented realistic espionage setups using concealed equipment in suitcases or office furniture. The technique works through walls and doesn't require physical access to target devices. While maximum range requires amplification, shorter distances can be achieved with basic SDR equipment. This makes the attack feasible for various threat actors. The paper specifically mentions risks for confidential conversations conducted over headphones or landlines in sensitive environments.
6Analog path vulnerability
InjectEave's critical insight is that analog components remain unprotected by digital security measures. Encryption, masking, and randomization defenses are ineffective as the attack captures signals before digital processing. The researchers emphasize this creates a fundamental security gap in modern devices that prioritize digital protections while neglecting analog signal integrity. This vulnerability persists across device generations as long as they contain the same basic analog components.
7Limited mitigation options
Potential countermeasures include twisted-pair wiring, shielding, and filtering to reduce injected signal coupling. However, the researchers note these only raise the difficulty bar without guaranteeing immunity. Complete protection would require redesigning analog components or adding active counter-signal measures - solutions impractical for most consumer devices. The paper suggests manufacturers should consider analog security in future designs, especially for sensitive applications.
8Security paradigm shift needed
InjectEave demonstrates that analog components represent a growing attack surface as digital defenses improve. The research calls for a fundamental reevaluation of hardware security assumptions, particularly regarding electromagnetic leakage. With the proliferation of IoT and always-on devices, such side-channel risks will only increase. This work likely represents just the beginning of active EM injection research, with more sophisticated attacks expected to follow.