skip to main content
10.1145/3460120.3484775acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

Glowworm Attack: Optical TEMPEST Sound Recovery via a Device's Power Indicator LED

Published: 13 November 2021 Publication History

Abstract

Two main classes of optical TEMPEST attacks against the confidentiality of information processed/delivered by devices have been demonstrated in the past two decades; the first class includes methods for recovering content from monitors, and the second class includes methods for recovering keystrokes from physical and virtual keyboards. In this paper, we identify a new class of optical TEMPEST attacks: recovering sound by analyzing optical emanations from a device's power indicator LED. We analyze the response of the power indicator LED of various devices to sound and show that there is an optical correlation between the sound that is played by connected speakers and the intensity of their power indicator LED due to the facts that: (1) the power indicator LED of various devices is connected directly to the power line, (2) the intensity of a device's power indicator LED is correlative to the power consumption, and (3) many devices lack a dedicated means of countering this phenomenon. Based on our findings, we present the Glowworm attack, an optical TEMPEST attack that can be used by eavesdroppers to recover sound by analyzing optical measurements obtained via an electro-optical sensor directed at the power indicator LED of various devices (e.g., speakers, USB hub splitters, and microcontrollers). We propose an optical-audio transformation (OAT) to recover sound in which we isolate the speech from optical measurements obtained by directing an electro-optical sensor at a device's power indicator LED. Finally, we test the performance of the Glowworm attack in various experimental setups and show that an eavesdropper can apply the attack to recover speech from speakers' power LED indicator with good intelligibility from a distance of 15 meters and with fair intelligibility from 35 meters.

References

[1]
[n.d.]. Creative Pebble Speakers. https://us.creative.com/p/speakers/creativepebble
[2]
[n.d.]. Facts About Speech Intelligibility. https://www.dpamicrophones.com/micuniversity/facts-about-speech-intelligibility.
[3]
[n.d.]. Google-home. https://store.google.com/us/product/google_nest_mini?hl=en-US
[4]
[n.d.]. Intelligibility. https://en.wikipedia.org/wiki/Intelligibility_(communication).
[5]
[n.d.]. Logitech S-120. https://www.amazon.com/Logitech-S120--2-0-Stereo-Speakers/dp/B000R9AAJA/
[6]
[n.d.]. MIRACASE MHUB500 USB Hub Splitter. https://www.amazon.com/TPLink-Portable-Ethernet-Notebooks-UE330/dp/B01N9M32TA/
[7]
[n.d.]. MPU 6050 GY-521 3 Axis Gyro Accelerometer Sensor Module Arduino. http://xtcomp.co.za/image/catalog/GY-521.pdf
[8]
[n.d.]. NI 9234 Datasheet. https://www.ni.com/pdf/manuals/374238a_02.pdf
[9]
[n.d.]. PDA100A2. https://www.thorlabs.com/thorproduct.cfm?partnumber=PDA100A2
[10]
[n.d.]. TP-Link UE330 USB. https://www.amazon.com/TP-Link-Portable-Ethernet-Notebooks-UE330/dp/B01N9M32TA/
[11]
[n.d.]. Winner Desktop Speakers. http://www.tonewinner.com/english/
[12]
Dakshi Agrawal, Bruce Archambeault, Josyula R Rao, and Pankaj Rohatgi. 2002. The EM side-channel (s). In International workshop on cryptographic hardware and embedded systems. Springer, 29--45.
[13]
S. A. Anand and N. Saxena. [n.d.]. Speechless: Analyzing the Threat to Speech Privacy from Smartphone Motion Sensors. In 2018 IEEE Symposium on Security and Privacy (SP), Vol. 00. 116--133. https://doi.org/10.1109/SP.2018.00004
[14]
Dmitri Asonov and Rakesh Agrawal. 2004. Keyboard acoustic emanations. In IEEE Symposium on Security and Privacy, 2004. Proceedings. 2004. IEEE, 3--11.
[15]
Zhongjie Ba, Tianhang Zheng, Xinyu Zhang, Zhan Qin, Baochun Li, Xue Liu, and Kui Ren. 2020. Learning-based practical smartphone eavesdropping with built-in accelerometer. In Proceedings of the Network and Distributed Systems Security (NDSS) Symposium. 23--26.
[16]
Michael Backes, Tongbo Chen, Markus Dürmuth, Hendrik PA Lensch, and Martin Welk. 2009. Tempest in a teapot: Compromising reflections revisited. In 2009 30th IEEE Symposium on Security and Privacy. IEEE, 315--327.
[17]
Michael Backes, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder. 2010. Acoustic Side-Channel Attacks on Printers. In USENIX Security symposium, Vol. 10. 307--322.
[18]
Michael Backes, Markus Dürmuth, and Dominique Unruh. 2008. Compromising reflections-or-how to read LCD monitors around the corner. In 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, 158--169.
[19]
Davide Balzarotti, Marco Cova, and Giovanni Vigna. 2008. Clearshot: Eavesdropping on keyboard input from video. In 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, 170--183.
[20]
Yigael Berger, Avishai Wool, and Arie Yeredor. 2006. Dictionary attacks using keyboard acoustic emanations. In Proceedings of the 13th ACM conference on Computer and communications security. 245--254.
[21]
Graham Brooker and Jairo Gomez. 2013. Lev Termen's Great Seal bug analyzed. IEEE Aerospace and Electronic Systems Magazine 28, 11 (2013), 4--11.
[22]
Giovanni Camurati, Sebastian Poeplau, Marius Muench, Tom Hayes, and Aurélien Francillon. 2018. Screaming channels: When electromagnetic side channels meet radio transceivers. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 163--177.
[23]
Jieun Choi, Hae-Yong Yang, and Dong-Ho Cho. 2020. TEMPEST Comeback: A Realistic Audio Eavesdropping Threat on Mixed-Signal SoCs. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, USA) (CCS '20). Association for Computing Machinery, New York, NY, USA, 1085--1101. https://doi.org/10.1145/3372297.3417241
[24]
Abe Davis, Michael Rubinstein, NealWadhwa, Gautham J Mysore, Frédo Durand, and William T Freeman. 2014. The visual microphone: passive recovery of sound from video. (2014).
[25]
Jeffrey Friedman. 1972. Tempest: A signal problem. NSA Cryptologic Spectrum 35 (1972), 76.
[26]
Karine Gandolfi, Christophe Mourtel, and Francis Olivier. 2001. Electromagnetic analysis: Concrete results. In International workshop on cryptographic hardware and embedded systems. Springer, 251--261.
[27]
John S Garofolo, Lori F Lamel, William M Fisher, Jonathan G Fiscus, and David S Pallett. 1993. DARPA TIMIT acoustic-phonetic continous speech corpus CD-ROM. NIST speech disc 1--1.1. STIN 93 (1993), 27403.
[28]
Daniel Genkin, Mihir Pattani, Roei Schuster, and Eran Tromer. 2019. Synesthesia: Detecting screen content via remote acoustic side channels. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 853--869.
[29]
Daniel Genkin, Adi Shamir, and Eran Tromer. 2014. RSA key extraction via lowbandwidth acoustic cryptanalysis. In Annual Cryptology Conference. Springer, 444--461.
[30]
Dennis RE Gnad, Jonas Krautter, and Mehdi B Tahoori. 2019. Leaky noise: New side-channel attack vectors in mixed-signal IoT devices. IACR Transactions on Cryptographic Hardware and Embedded Systems (2019), 305--339.
[31]
François Grondin, A Vakili, and L Demers. 2014. Guitar Pitch Shifter. http://www.guitarpitchshifter.com/about.html.
[32]
Mordechai Guri, Yosef Solewicz, Andrey Daidakulov, and Yuval Elovici. 2017. SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit. In 11th USENIX Workshop on Offensive Technologies (WOOT 17). USENIX Association, Vancouver, BC. https://www.usenix.org/conference/woot17/workshop-program/presentation/guri
[33]
Mordechai Guri, Boris Zadov, Dima Bykhovsky, and Yuval Elovici. 2019. Ctrl-alt-led: Leaking data from air-gapped computers via keyboard leds. In 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC), Vol. 1. IEEE, 801--810.
[34]
Mordechai Guri, Boris Zadov, Andrey Daidakulov, and Yuval Elovici. 2018. xled: Covert data exfiltration from air-gapped networks via switch and router leds. In 2018 16th Annual Conference on Privacy, Security and Trust (PST). IEEE, 1--12.
[35]
Mordechai Guri, Boris Zadov, and Yuval Elovici. 2017. LED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED. In International conference on detection of intrusions and malware, and vulnerability assessment. Springer, 161--184.
[36]
Avesta Hojjati, Anku Adhikari, Katarina Struckmann, Edward Chou, Thi Ngoc Tho Nguyen, Kushagra Madan, Marianne S Winslett, Carl A Gunter, and William P King. 2016. Leave your phone at the door: Side channels that reveal factory floor secrets. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 883--894.
[37]
Vasu Iyengar, Rafi Rabipour, Paul Mermelstein, and Brian R Shelton. 1995. Speech bandwidth extension method and apparatus. US Patent 5,455,888.
[38]
Peter Jax and Peter Vary. 2003. On artificial bandwidth extension of telephone speech. Signal Processing 83, 8 (2003), 1707--1719.
[39]
Sean King. 2008. Luminous Intensity of an LED as a Function of Input Power. ISB J. Phys 2, 2 (2008), Paper--number.
[40]
Paul Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential power analysis. In Annual international cryptology conference. Springer, 388--397.
[41]
Paul Kocher, Joshua Jaffe, Benjamin Jun, and Pankaj Rohatgi. 2011. Introduction to differential power analysis. Journal of Cryptographic Engineering 1, 1 (2011), 5--27.
[42]
Markus G Kuhn. 2002. Optical time-domain eavesdropping risks of CRT displays. In Proceedings 2002 IEEE Symposium on Security and Privacy. IEEE, 3--18.
[43]
A. Kwong, W. Xu, and K. Fu. 2019. Hard Drive of Hearing: Disks that Eavesdrop with a Synthesized Microphone. In 2019 2019 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, Los Alamitos, CA, USA. https://doi.org/ 10.1109/SP.2019.00008
[44]
Jeremy Landt. 2005. The history of RFID. IEEE potentials 24, 4 (2005), 8--11.
[45]
Sen Li, Stéphane Villette, Pravin Ramadas, and Daniel J Sinder. 2018. Speech bandwidth extension using generative adversarial networks. In 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 5029--5033.
[46]
Xiangyu Liu, Zhe Zhou, Wenrui Diao, Zhou Li, and Kehuan Zhang. 2015. When good becomes evil: Keystroke inference with smartwatch. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 1273--1285.
[47]
Zhuoran Liu, Niels Samwel, Léo Weissbart, Zhengyu Zhao, Dirk Lauret, Lejla Batina, and Martha Larson. 2020. Screen Gleaning: A Screen Reading TEMPEST Attack on Mobile Devices Exploiting an Electromagnetic Side Channel. arXiv preprint arXiv:2011.09877 (2020).
[48]
Joe Loughry. 2018. Optical TEMPEST. In 2018 International Symposium on Electromagnetic Compatibility (EMC EUROPE). IEEE, 172--177.
[49]
Joe Loughry and David A Umphress. 2002. Information leakage from optical emanations. ACM Transactions on Information and System Security (TISSEC) 5, 3 (2002), 262--289.
[50]
Stefan Mangard, Elisabeth Oswald, and Thomas Popp. 2008. Power analysis attacks: Revealing the secrets of smart cards. Vol. 31. Springer Science & Business Media.
[51]
Yan Michalevsky, Dan Boneh, and Gabi Nakibly. 2014. Gyrophone: Recognizing Speech from Gyroscope Signals. In 23rd USENIX Security Symposium (USENIX Security 14). USENIX Association, San Diego, CA, 1053--1067. https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/michalevsky
[52]
Keaton Mowery, Sarah Meiklejohn, and Stefan Savage. 2011. Heat of the moment: Characterizing the efficacy of thermal camera-based attacks. In Proceedings of the 5th USENIX conference on Offensive technologies. 6--6.
[53]
Ralph P Muscatell. 1983. Laser microphone. US Patent 4,412,105.
[54]
Ben Nassi, Yaron Pirutin, Adi Shamir, Yuval Elovici, and Boris Zadov. [n.d.]. Lamphone: Real-Time Passive Sound Recovery from Light Bulb Vibrations. Technical Report. Cryptology ePrint Archive.
[55]
Hannu Pulakka and Paavo Alku. 2011. Bandwidth extension of telephone speech using a neural network and a filter bank implementation for highband mel spectrum. IEEE Transactions on Audio, Speech, and Language Processing 19, 7 (2011), 2170--2183.
[56]
Hannu Pulakka, Ulpu Remes, Santeri Yrttiaho, Kalle Palomaki, Mikko Kurimo, and Paavo Alku. 2012. Bandwidth extension of telephone speech to low frequencies using sinusoidal synthesis and a Gaussian mixture model. IEEE transactions on audio, speech, and language processing 20, 8 (2012), 2219--2231.
[57]
Schuyler R Quackenbush, Thomas Pinkney Barnwell, and Mark A Clements. 1988. Objective measures of speech quality. Prentice Hall.
[58]
Jean-Jacques Quisquater and David Samyde. 2001. Electromagnetic analysis (ema): Measures and counter-measures for smart cards. In International Conference on Research in Smart Cards. Springer, 200--210.
[59]
Rahul Raguram, Andrew M White, Dibyendusekhar Goswami, Fabian Monrose, and Jan-Michael Frahm. 2011. iSpy: automatic reconstruction of typed input from compromising reflections. In Proceedings of the 18th ACM conference on Computer and communications security. 527--536.
[60]
Rahul Raguram, Andrew M White, Yi Xu, Jan-Michael Frahm, Pierre Georgel, and Fabian Monrose. 2013. On the privacy risks of virtual keyboards: automatic reconstruction of typed input from compromising reflections. IEEE Transactions on Dependable and Secure Computing 10, 3 (2013), 154--167.
[61]
Nirupam Roy and Romit Roy Choudhury. 2016. Listening Through a Vibration Motor. In Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services (Singapore, Singapore) (MobiSys '16). ACM, New York, NY, USA, 57--69. https://doi.org/10.1145/2906388.2906415
[62]
Sriram Sami, Yimin Dai, Sean Rui Xiang Tan, Nirupam Roy, and Jun Han. 2020. Spying with Your Robot Vacuum Cleaner: Eavesdropping via Lidar Sensors. In Proceedings of the 18th Conference on Embedded Networked Sensor Systems (Virtual Event, Japan) (SenSys '20). Association for Computing Machinery, New York, NY, USA, 354--367. https://doi.org/10.1145/3384419.3430781
[63]
Diksha Shukla, Rajesh Kumar, Abdul Serwadda, and Vir V Phoha. 2014. Beware, your hands reveal your secrets!. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 904--917.
[64]
Chen Song, Feng Lin, Zhongjie Ba, Kui Ren, Chi Zhou, andWenyao Xu. 2016. My smartphone knows what you print: Exploring smartphone-based side-channel attacks against 3d printers. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 895--907.
[65]
Cees H Taal, Richard C Hendriks, Richard Heusdens, and Jesper Jensen. 2011. An algorithm for intelligibility prediction of time--frequency weighted noisy speech. IEEE Transactions on Audio, Speech, and Language Processing 19, 7, 2125--2136.
[66]
Navneet Upadhyay and Abhijit Karmakar. 2015. Speech enhancement using spectral subtraction-type algorithms: A comparison and simulation study. Procedia Computer Science 54 (2015), 574--584.
[67]
Wim Van Eck. 1985. Electromagnetic radiation from video display units: An eavesdropping risk? Computers & Security 4, 4 (1985), 269--286.
[68]
G. Wang, Y. Zou, Z. Zhou, K. Wu, and L. M. Ni. 2016. We Can Hear You with Wi-Fi! IEEE Transactions on Mobile Computing 15, 11 (Nov 2016), 2907--2920. https://doi.org/10.1109/TMC.2016.2517630
[69]
He Wang, Ted Tsung-Te Lai, and Romit Roy Choudhury. 2015. Mole: Motion leaks through smartwatch sensors. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking. 155--166.
[70]
Teng Wei, Shu Wang, Anfu Zhou, and Xinyu Zhang. 2015. Acoustic Eavesdropping Through Wireless Vibrometry. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (Paris, France) (MobiCom '15). ACM, New York, NY, USA, 130--141. https://doi.org/10.1145/2789168.2790119
[71]
Yi Xu, Jared Heinly, Andrew M White, Fabian Monrose, and Jan-Michael Frahm. 2013. Seeing double: Reconstructing obscured typed input from repeated compromising reflections. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security. 1063--1074.
[72]
Qinggang Yue, Zhen Ling, Xinwen Fu, Benyuan Liu, Kui Ren, andWei Zhao. 2014. Blind recognition of touched keys on mobile devices. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 1403--1414.
[73]
Li Zhang, Parth H Pathak, Muchen Wu, Yixin Zhao, and Prasant Mohapatra. 2015. Accelword: Energy efficient hotword detection through accelerometer. In Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services. ACM, 301--315.
[74]
Li Zhuang, Feng Zhou, and J Doug Tygar. 2009. Keyboard acoustic emanations revisited. ACM Transactions on Information and System Security (TISSEC) 13, 1 (2009), 1--26.

Cited By

View all

Index Terms

  1. Glowworm Attack: Optical TEMPEST Sound Recovery via a Device's Power Indicator LED

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
    November 2021
    3558 pages
    ISBN:9781450384544
    DOI:10.1145/3460120
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Sponsors

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 13 November 2021

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. IoT
    2. privacy
    3. sound recovery
    4. tempest

    Qualifiers

    • Research-article

    Conference

    CCS '21
    Sponsor:
    CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security
    November 15 - 19, 2021
    Virtual Event, Republic of Korea

    Acceptance Rates

    Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

    Upcoming Conference

    CCS '25

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)80
    • Downloads (Last 6 weeks)20
    Reflects downloads up to 29 Jan 2025

    Other Metrics

    Citations

    Cited By

    View all

    View Options

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Figures

    Tables

    Media

    Share

    Share

    Share this Publication link

    Share on social media