Shiny objects can be used to eavesdrop on conversations

A group of cyber-researchers recently revealed an experiment that can recover audio inside a room by measuring the light reflected from reflective objects such as cans. How is modern technology enabling new types of attacks, what did the researchers present, and is it a threat?

How is modern technology enabling new cyberattacks?

As new technologies are developed, researchers and engineers find new ways to make modern life better, whether connecting people across the planet, discovering new medicines, or developing new forms of entertainment. But just as there cannot be Ying without Yang, positive developments almost always come with something negative, and this couldn’t be truer in the field of computers.

A golden example of this is the Internet. The introduction of the internet marked the first time in human history where information could be easily shared instantly with no need for travelling. This allowed for people all over the globe to connect regardless of country boundaries, and those with similar interests could get together and form friendships never possible before. However, the internet also brought many negatives, including easy access to illicit content, allowing those with concerning interests to form groups and feel normalised, and providing an entry point for criminals to steal information.

In the field of computers, any new technology development will undoubtedly include at least one vulnerability unknown to the original developers. This is generally due to the extreme complexity of such technology, and its implementation may vary between designers. For example, the SSL Heartbleed bug allowed criminals to obtain data from server RAM by asking for more data than what was sent. Simply put, the lack of comparison between the message sent and the requested response allowed attackers to dump the contents of RAM, which could be used to obtain private data such as keys and login information.

Cyber-researchers demonstrate how shiny objects can record audio

To demonstrate how far technology has come, a group of cyber-researchers have recently demonstrated how reflective objects in a room can be used to record audio. In order to achieve this, the researchers rely on a telescope and a sensitive photodiode that can accurately measure minute changes in reflected light from a surface. In the presence of strong vibrations, a reflective surface will move slightly, altering the amount of light being reflected from its surface.

These minute changes in reflection can be picked up by a photodiode, and an ADC can then be used to digitise the information. From there, the researchers demonstrated that it is possible for audio to be recovered from the room as described in this presentation. The method for eavesdropping has been named “The Little Seal” by the researchers in homage to the Russian snooping device “The Thing”, a large wooden seal gifted to the US president in 1945.

The researchers demonstrated that the attack can be done over distances of 35 meters which puts plenty of distance between the attacker and the target. Worse, the attacker doesn’t require access to the room in any way, with the only requirement being a well-lit room. The researchers also demonstrated that audio could be recovered from Venetian blinds, commonly found in offices, a Rubix cube and a smartphone stand. These objects are not required to be hanging from a piece of string (like the lamphone attack).

Is such an attack really a threat?

While the researchers did demonstrate that the attack can be used to eavesdrop, it is unlikely to be a chosen method for attackers due to its involved nature. Furthermore, an eavesdropper would need to be close to a target who is speaking loudly for any information to be recovered, which would significantly increase the risk of being caught. If this technique was to be deployed, it is likely to be a chosen method for spy agencies due to its non-invasive nature and access to high-tech equipment.

That isn’t to say that such attacks won’t become mainstream in the future, as advances in technology can simplify the use of such an attack. Furthermore, reflective objects are ubiquitous, and preventing any reflective objects from having a few of the outside world is impractical. It may even be that future attackers will be able to look at reflections on the exterior glass to eavesdrop, and this would be extremely hard to defend against.

But for those looking to improve their security today, it is improbable that such an attack will be used against individuals for a very long time.