Laser-Based Audio Injection On Voice-Controllable Systems

In one of the cooler hacks we’ve seen recently, a bunch of hacking academics at the University of Michigan researched the ability to flicker a laser at audible sound frequencies to see if they could remotely operate microphones simply by shining a light on them. The results are outstanding.

While most Hackers will have heard about ‘The Thing’ – a famous hack where Russian KGB agents would aim a radio transmitter at the great seal in the US embassy,  almost none of us will have thought of using lasers shined in from distant locations to hack modern audio devices such as Alexa or Google Assistant. In the name of due diligence, we checked it out on Wikipedia: ‘The Photoacoustic Effect’ , and indeed it is real – first discovered in 1880 by Alexander Bell! The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity. Getting long range out of such a system is a non-trivial product of telescopes, lasers, and careful alignment, but it can be made to work.

Digging deeper into the hack, we find that the actual microphone that is vulnerable is the MEMS type, such as the Knowles SPV0842LR5H. This attack is relatively easy to prevent; manufacturers would simply need to install screens to prevent light from hitting the microphones. For devices already installed in our homes, we recommend either putting a cardboard box over them or moving them away from windows where unscrupulous neighbors or KGB agents could gain access. This does make us wonder if MEMS mics are also vulnerable to radio waves.

As far as mobile phones are concerned, the researchers were able to talk into an iPhone XR at 10 metres, which means that, very possibly, anybody with a hand held ultra violet / infra red equipped flashlight could hack our phones at close range in a bar, for example. The counter-measures are simple – just stick some black electrical tape over the microphone port at the bottom of the phone. Or stay out of those dodgy bars.

25 thoughts on “Laser-Based Audio Injection On Voice-Controllable Systems

  1. A mate of mine used to do something similar and would walk around his village changing the channel on everyone’s satellite receiver to Babestation, using his own remote pointed through their windows.

  2. > The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity.

    > just stick some black electrical tape over the microphone port at the bottom of the phone.

    Tape would work as a good surface reacting to laser energy, so probably that is not a good countermeasure.

      1. This is only the case for long wave infrared (and for some plastics medium wave as well). It is opaque to short wave and near IR, as used here.

        If you ever need to make a picture with you thermal camera in the rain and you are afraid of it getting wet, just put a garbage bag over it, most are quite transparent.

  3. > “For devices already installed in our homes, we recommend either putting a cardboard box over them or moving them away from windows…”

    Better yet, open the window and yeet these privacy-invading devices out into oncoming traffic :)

    1. The wikipedia article on the photoacoustic effect says that it can be caused by any EM radiation from IR to Gamma Ray, so if they tried this with X-Rays you’ed need to put your Google Whatits in a lead box.

  4. Electrical tape is a temporary fix. The use of Laser Doppler vibrometers or LRAD small scale ultrasound systems make the whole device housing will work like a loudspeaker. :/

  5. during the video playback Alex proceeded to give me the weather forecast. I never really look into it, can these devices be trained recognize simple phrases? For the garage door example; Oscar Golf Delta, that could be shortened to OGD. My dot’s microns looks to be under a small hole on the top. That and it’s location, makes for a difficult target.

  6. I’m expecting this to show up in Ocean however-many-people-are-involved-now soon. (c:

    The one through a window scares me a bit, only because if cops notice it (i.e., they get a flash from the laser), they tend to get really upset. Rightfully so, too.

  7. >The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity.

    I guess you didn’t read the paper? MEMs microphones are not being directly hit by the laser light or heated by it. The laser light is hitting the case and heating it. MEMs microphones are just unique in that they are mounted mechanically directly on the case. The laser light heats the case and the sound travels through it to the MEMs microphone hanging off it.

  8. I’m a little late to the comment party, but I have some experience with this phenomenon. It is actually due to the light sensitivity of the analog circuitry inside the mic, not the photoacoustic effect. Or at least, the signal from the photoacoustic effect is orders of magnitude weaker than that of simple silicon light sensitivity.

    There is an ASIC inside MEMS mics with a very high gain preamplifier. One of the quirks of silicon design for analog signals is that larger transistors have lower noise, so these chips are made using a relatively large silicon process. Combine light sensitivity (the same phenomenon that enables LEDs to be used as photodiodes), large transistors (which pick up more light), and high gain, and you have a decent analog light sensor. MEMs mic makers know about this, and use a light-blocking coating over the ASIC to reduce the mic’s sensitivity to stray light, but very strong and/or very targeted light can still be picked up.

    I worked on a project that used powerful IR LEDs near some MEMS microphones, which picked up a terrible buzzing noise any time the LEDs pulsed. We were stumped searching for noise in ground connections or other electrical Gremlins, until one of the optics guys suggested the amp might be picking up light, just like a CMOS sensor. He was right, and we eventually ended up swapping the clear plastic part that the mics were mounted on for a nice IR-blocking black. Problem solved.

  9. OK. Countermeasure for this phenomena?

    Infrared Cut Filters

    However, they can be expensive. Even from Edmund Scientific in New Jersey (USA).

    So how can you make your own Alexa Echo Infrared Cut filter box?

    Well you know that old celluloid film stock you used to have? Its still available at Walmart. You just need to get a roll of it, expose it to light, have Walmart develop it for you, then glue together 3 layers of it into a box like container for your Echo device in your window. Not only does it stop the sun from baking your unit, it stops the spooks from painting it with an IR LASER. Visible LASERS are too obvious to see with naked eye. Walmart sells a device for $39 bucks (Night Hero) that uses IR LASER to paint distant objects so its IR binoculars can see it. That would work well in spotting spooks painting your window for LASER mics and this gadget too.

    You can program Alexa to verify a sensitive command (like credit card transaction) with some sort of SKILL, like a pass phrase.Opening or unlocking any exterior door is considered sensitive.

    https://us.123rf.com/450wm/fablok/fablok1410/fablok141000006/32451810-colored-celluloid-film-on-a-white-background.jpg

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.