Drops the mic... Hang on, hackers could be listening through my headphones? Experimental malware has highlighted the possibility that hackers might be able to turn headphones into microphones in order to snoop on computer users. Research by computer scientists at Ben-Gurion University, Israel, has revealed that both headphones and loudspeakers present a potential bugging risk. The boffins put together …
That implies the sound chip connects to speaker(s) directly (maybe class D), in the past the sound chip used a separate analogue amp to drive the speakers, which as they point out, blocks the attack.
Strange too, that the pins are reprogrammable, like a PIC micro etc.
What next? The LCD screen capacitance sensed and thus acting as microphone?
A lot of PCs have retaskable audio jacks at the hardware level - but the firmware and drivers differ between models. Some PCs would bring up a port selection dialogue when a 3.5mm plug was inserted.
I have spent a few minutes seeing if can do the same - my headphone jack is damaged, so it would suit me to reassign the microphone port. However, it would probably be quicker for me to open the machine and re-solder the port than it would to faff around with software and drivers. As far as I can make out, the IDT drivers allowed port remapping in XP, but don't in Win 7. Screwdriver time...
Oh, just to clarify, Class D amplifiers are not 'digital', though people often refer to them as such.
>Also, I guess I'm getting old, we used to use speakers as microphones when I was a kid because we didn't have all the stuff kids have nowadays.
Same here. First, I discovered that microphone worked as a speaker, when I was about 7 year old. Later, I used some earbuds to record sound onto a Mac LCIII at school. Certainly not hi-fi quality, but speech was comprehensible.
Also, the port remapping isn't unheard of - many XP-era desktops would present a dialogue asking what kind of device had just been plugged in. Of course, this facility in hardware doesn't translate to helping me right here and now remap my unused mic jack as an audio out.
Same here. First, I discovered that microphone worked as a speaker, when I was about 7 year old. Later, I used some earbuds to record sound onto a Mac LCIII at school. Certainly not hi-fi quality, but speech was comprehensible.
Same here. I made a tin-cans-and-string replacement at that age using only two 150Ω speakers and 25m of cable - no batteries or electronics needed :).
This datasheet from RealTek
http://realtek.info/pdf/ALC888_1-0.pdf
appears to show (section 4) that each audio channel is actually 'general purpose' in its design with output and input amplifiers.
"each audio channel is actually 'general purpose' in its design with output and input amplifiers."
no good deed (totally programmable audio channels) goes unpunished [being used for exploits]
BOM cost just went up by a dollar, to add a couple of power amps between audio chip and speakers/headphones, to stop this.
Too often do we forget what it is we actually use, so deep is the habit of just considering what it does.
This is truly what is called thinking out of the box. Kudos to the team that put this experiment together.
I have no idea what the impact could be though. Granted, there is some pretty intelligent scum out there, and the NSA must be paying great attention, but I can't see that this is going to be a risk to the general public. Your run-of-the-mill scammer is not going to waste time setting up an entire software chain and phone-home capability just to hear traffic, crowds or people burping and farting.
In theory (not having read the particulars) the built-in speakers would go through the same audio channels and -being both small/light and firmly fixed in the chassis- built-in speakers would be the target of choice for good audio by the attackers...they aren't going to be muffled by ears like headphones and they are going to be more sensitive than a couple of floor-monsters that don't move until you slam 300W through them.
going to be more sensitive than a couple of floor-monsters that don't move until you slam 300W through them.That 300W is for the low end. Mid-range and high frequencies don't need anywhere near that and those are the frequencies of interest. The real difficulty is transferring the information those transducers are already picking up to where they can be useful.
Even if the scum could get the dodgy code on to your computer to do this little stunt, wouldn't the user be able to tell when the audio attempting to play didn't work? If the scum are using the speakers as microphones then they shouldn't work as *speakers* at the same time, correct? So if your speakers suddenly stop working then it's time to grab a fresh set of drivers from the manufacturer's site? Or, I dunno, unplug the speakers...
""Malware can use a computer as an eavesdropping device, even when a microphone is not present, muted, taped or turned off,"
Taped? Because sound doesn't go through tape?
Or did they get that mixed up with the camera?
I'm willing to bet that a taped condenser mic will perform better than a pair of headphones -as a microphone, of course...
An opportunity arises!
I will market a Styrofoam "head" containing a simple sound chip with a looped sample burned in.
The "ears" will be speakers.
One simply places the headphones over the "head" and pressure-activated micro-switches turn the thing on, delivering unobtrusive-to-the-owner playback of "Hey Mickey" to the hackers, earworming them for their trouble.
The device will be completely and utterly airgapped since it will never need an upgrade over the web. Should the hackers ever develop an immunity to "Hey Mickey" (all-but impossible), a mail-in card will cause a new proprietary chip to be sent out that can be substituted for the original. This new chip will contain the subscriber's choice of "Sugar Sugar", "Chirpy Chirpy Cheep Cheep" or "Love Grows Where My Rosemary Goes".
Premium subscribers can access nuclear options like "Da Da Da", "Two Little Boys", or "I Was Born Under A Wandrin' Star".
Thank you for listing the three "Nuclear Options" together. Just naming them is enough to trigger the earworm. Fortuitously, naming them together, in a group, makes them compete and they each cancel out the other two.
Now I will be the bastard and point out the one you missed: MaNaMiNa
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
