In one of the cooler hacks we’ve seen recently, a bunch of hacking academics at the University of Michigan researched the ability to flicker a laser at audible sound frequencies to see if they could remotely operate microphones simply by shining a light on them. The results are outstanding.
While most Hackers will have heard about ‘The Thing’ – a famous hack where Russian KGB agents would aim a radio transmitter at the great seal in the US embassy, almost none of us will have thought of using lasers shined in from distant locations to hack modern audio devices such as Alexa or Google Assistant. In the name of due diligence, we checked it out on Wikipedia: ‘The Photoacoustic Effect’ , and indeed it is real – first discovered in 1880 by Alexander Bell! The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity. Getting long range out of such a system is a non-trivial product of telescopes, lasers, and careful alignment, but it can be made to work.
Digging deeper into the hack, we find that the actual microphone that is vulnerable is the MEMS type, such as the 
Knowles SPV0842LR5H. This attack is relatively easy to prevent; manufacturers would simply need to install screens to prevent light from hitting the microphones. For devices already installed in our homes, we recommend either putting a cardboard box over them or moving them away from windows where unscrupulous neighbors or KGB agents could gain access. This does make us wonder if MEMS mics are also vulnerable to radio waves.
As far as mobile phones are concerned, the researchers were able to talk into an iPhone XR at 10 metres, which means that, very possibly, anybody with a hand held ultra violet / infra red equipped flashlight could hack our phones at close range in a bar, for example. The counter-measures are simple – just stick some black electrical tape over the microphone port at the bottom of the phone. Or stay out of those dodgy bars.
A mate of mine used to do something similar and would walk around his village changing the channel on everyone’s satellite receiver to Babestation, using his own remote pointed through their windows.
But that was attacking a light-based system, using light.
This is using light (which we can send through windows, from a distance) to exploit sound-based systems.
> The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity.
…
> just stick some black electrical tape over the microphone port at the bottom of the phone.
Tape would work as a good surface reacting to laser energy, so probably that is not a good countermeasure.
All the tape I tested while developing a product with an IR proximity sensor was complexly transparent to the IR the sensor used. The carbon black that tape and many plastics use to be black is more or less worthless at stopping IR.
This is only the case for long wave infrared (and for some plastics medium wave as well). It is opaque to short wave and near IR, as used here.
If you ever need to make a picture with you thermal camera in the rain and you are afraid of it getting wet, just put a garbage bag over it, most are quite transparent.
Pretty cool research results, but I still prefer the laser pointer exploit in secret life of pets 2
https://www.youtube.com/watch?v=JnuYlFhXWsU
> “For devices already installed in our homes, we recommend either putting a cardboard box over them or moving them away from windows…”
Better yet, open the window and yeet these privacy-invading devices out into oncoming traffic :)
And get rid of your screwdrivers because they know what you’re thinking.
I think Project Alias would be a good remedy for both issues. Simply tweak the 3d print a little bit to create a non-direct path for the microphone and you are set. It is a shame Hackaday did not link it in the article.
https://hackaday.com/2019/01/17/win-back-some-privacy-with-a-cone-of-silence-for-your-smart-speaker/
No- wouldn’t a “true” hacker mine the devices for items that use, if they are going to get ride of them?
The wikipedia article on the photoacoustic effect says that it can be caused by any EM radiation from IR to Gamma Ray, so if they tried this with X-Rays you’ed need to put your Google Whatits in a lead box.
Laser blocking films in 3…2…1.
Electrical tape is a temporary fix. The use of Laser Doppler vibrometers or LRAD small scale ultrasound systems make the whole device housing will work like a loudspeaker. :/
during the video playback Alex proceeded to give me the weather forecast. I never really look into it, can these devices be trained recognize simple phrases? For the garage door example; Oscar Golf Delta, that could be shortened to OGD. My dot’s microns looks to be under a small hole on the top. That and it’s location, makes for a difficult target.
Impressive, but wouldn’t such a powerful IR laser have much more damaging uses? Like blinding to homeowner?
I’m expecting this to show up in Ocean however-many-people-are-involved-now soon. (c:
The one through a window scares me a bit, only because if cops notice it (i.e., they get a flash from the laser), they tend to get really upset. Rightfully so, too.
MEMS microphones? So, would they be affected by Helium like MEMS oscillatiors? Makes me wonder if popping helium balloons next to these devices would kill their utility quickly.
probably not, regarding the operating frequencies here.
The helium only distorted the MEMS oscillators enough to matter
Ah, yes, the beauty of a fully automated home to save you from making trivial efforts to do trivial things:
https://vimeo.com/178324074
Very cool!
But the music in the videos is anoying af…
>The pulsing light is heating the microphone element and causing it to vibrate along with the beam’s intensity.
I guess you didn’t read the paper? MEMs microphones are not being directly hit by the laser light or heated by it. The laser light is hitting the case and heating it. MEMs microphones are just unique in that they are mounted mechanically directly on the case. The laser light heats the case and the sound travels through it to the MEMs microphone hanging off it.
So, put tape over your microphones and muffle the sound getting to them. Smart…
I’m a little late to the comment party, but I have some experience with this phenomenon. It is actually due to the light sensitivity of the analog circuitry inside the mic, not the photoacoustic effect. Or at least, the signal from the photoacoustic effect is orders of magnitude weaker than that of simple silicon light sensitivity.
There is an ASIC inside MEMS mics with a very high gain preamplifier. One of the quirks of silicon design for analog signals is that larger transistors have lower noise, so these chips are made using a relatively large silicon process. Combine light sensitivity (the same phenomenon that enables LEDs to be used as photodiodes), large transistors (which pick up more light), and high gain, and you have a decent analog light sensor. MEMs mic makers know about this, and use a light-blocking coating over the ASIC to reduce the mic’s sensitivity to stray light, but very strong and/or very targeted light can still be picked up.
I worked on a project that used powerful IR LEDs near some MEMS microphones, which picked up a terrible buzzing noise any time the LEDs pulsed. We were stumped searching for noise in ground connections or other electrical Gremlins, until one of the optics guys suggested the amp might be picking up light, just like a CMOS sensor. He was right, and we eventually ended up swapping the clear plastic part that the mics were mounted on for a nice IR-blocking black. Problem solved.
Thanks for sharing this. This sounds much more reasonable to me than the light heating some membrane on the device.
OK. Countermeasure for this phenomena?
Infrared Cut Filters
However, they can be expensive. Even from Edmund Scientific in New Jersey (USA).
So how can you make your own Alexa Echo Infrared Cut filter box?
Well you know that old celluloid film stock you used to have? Its still available at Walmart. You just need to get a roll of it, expose it to light, have Walmart develop it for you, then glue together 3 layers of it into a box like container for your Echo device in your window. Not only does it stop the sun from baking your unit, it stops the spooks from painting it with an IR LASER. Visible LASERS are too obvious to see with naked eye. Walmart sells a device for $39 bucks (Night Hero) that uses IR LASER to paint distant objects so its IR binoculars can see it. That would work well in spotting spooks painting your window for LASER mics and this gadget too.
You can program Alexa to verify a sensitive command (like credit card transaction) with some sort of SKILL, like a pass phrase.Opening or unlocking any exterior door is considered sensitive.
https://us.123rf.com/450wm/fablok/fablok1410/fablok141000006/32451810-colored-celluloid-film-on-a-white-background.jpg
Or if not a box you can make a IR Cut Filter Wall out of a small picture frame with this film stock idea inserted. Just aim the frame at the window and put your ECHO on the other side of it. Or just put your ECHO somewhere else that’s not exposed to the window.
Put the Alexa or whatever device you have on a shelf just above or just below the window.