Hackers Can Now Use Your Own Headphones to Spy on You
A few months ago, a photo of Mark Zuckerberg found its way circulating around the Internet. The image (left) features the Facebook CEO positioned in front of his laptop, posing with a huge frame to celebrate Facebook-owned Instagram reaching 500 million users earlier that week. What made this photo the talk of the Internet wasn’t due to “the Gram’s” success, rather everyone was focused on the tape covering Zuckerberg’s webcam and microphone.
Though some called him overly paranoid for believing hackers were really watching his every move and listening in on his private conversations, this fear has been realized as hackers have created a malware that spies on you, not through your webcam, but via your microphone.
A malware, dubbed “SPEAKE(a)R,” converts your headphones into makeshift microphones that can spy on you and record your conversations without you even knowing it.
SPEAKE(a)R, developed by researchers in the Cyber Security Research Labs at Israel’s Ben-Gurion University, was created to show how hackers who are determined to do so could find a way to slyly hijack a computer to record audio in secret. Those who find themselves even more mistrusting of their computer’s microphone than Zuckerberg have gone to such lengths as disabling or completely removing the microphone from their computers; however, this defense does not match up to this malware. The malware alters the speakers in headphones and repurposes them to be used as microphones, “converting the vibrations in air into electromagnetic signals to clearly capture audio from across a room.”
SPEAKE(a)R can infect those headphones with a built-in microphone channel on the wire, such as Apple’s EarPods, as well as the old school versions without such advancements. The way it is able to do so it that the malware capitalizes on a feature of RealTek audio codec chips that is not commonly known. Hackers use this vulnerability to subtly change the computer’s output channel into an input channel. This allows the malware to record audio through any headphones plugged into a computer–a scary thought because these RealTek chips are extremely common. So common, in fact, that researchers have found that the attack could potentially infect almost any desktop computer, regardless of its operating system.
You can see this malware in action below:
As you can see above, the sound is initially recorded via a connected microphone; however, with the microphone turned off while still plugged in and even when it was unplugged entirely as well, the computer can still pick up the music from across the room when the SPEAKE(a)R malware converts the output channel to an input one, all because headphones are still plugged in, continually eavesdropping.
Currently, there is nothing short of entirely disabling all audio input and output from a computer as far as a defense against this vulnerability is concerned. RealTek and other audio codec chip creators can only prevent this from happening in the future by redesigning chips with a higher level of security. Until then, even going to such lengths as removing microphones will not be effective if you leave your headphones plugged into the computer.
Hailey R. Carlson | Axiom Cyber Solutions | 12/28/2016
