A group of researchers from five American universities has developed the EarSpy side-channel attack technique, which makes it possible to eavesdrop on phone conversations by analyzing information from motion sensors. The method is based on the fact that modern smartphones are equipped with a fairly sensitive accelerometer and gyroscope, which also respond to vibrations induced by the deviceβs low-power loudspeaker, which is used when communicating without a speakerphone. Using machine learning methods, the researcher was able to partially restore the speech heard on the device based on information received from motion sensors and determine the gender of the speaker.
Previously, it was believed that side-channel attacks involving motion sensors could only be carried out using powerful speakers used for hands-free calling, and speakers that sound when the phone is put to the ear do not lead to leaks. However, increasing sensor sensitivity and the use of more powerful dual-ear speakers in modern smartphones have changed the situation. The attack can be carried out in any mobile applications for the Android platform, since access to motion sensors is granted to applications without special permissions (with the exception of Android 13).
The use of a convolutional neural network and classical machine learning algorithms made it possible, when analyzing spectrograms generated based on data from the accelerometer on the OnePlus 7T smartphone, to achieve an accuracy of gender determination of 98.66%, speaker determination of 92.6%, and spoken digit determination of 56.42%. On the OnePlus 9 smartphone, these figures were 88.7%, 73.6% and 41.6%, respectively. When the speakerphone was turned on, the accuracy of speech recognition increased to 80%. To record data from the accelerometer, a standard Physics Toolbox Sensor Suite mobile application was used.
To protect against this type of attack, changes have already been made to the Android 13 platform that limit the accuracy of data from sensors provided without special powers to 200 Hz. When sampling at 200 Hz, the attack accuracy is reduced to 10%. It is additionally noted that in addition to the power and number of speakers, the accuracy is also greatly influenced by the proximity of the speakers to the motion sensors, the tightness of the housing and the presence of external interference from the environment.
Source: opennet.ru