A group of researchers from the National University of Singapore and Yonsei University (Korea) has developed a method to detect the hidden microphone on a laptop. To demonstrate the operation of the method based on the Raspberry Pi 4 board, amplifier and programmable transceiver (SDR), a prototype called TickTock was assembled, which allows you to detect microphone activation by malware or spyware to listen to the user. The technique of passively detecting the inclusion of a microphone is relevant because, in the case of a webcam, the user can block recording simply by sticking the camera, then turning off the built-in microphone is problematic and it is not clear when it is active and when it is not.
The method is based on the fact that when the microphone is operating, the circuits that transmit clock signals to the analog-to-digital converter begin to emit a specific background signal that can be captured and separated from the noise caused by the operation of other systems. By the presence of electromagnetic radiation specific to the microphone, it can be concluded that the recording is being made.
The device requires adaptation for different laptop models, since the nature of the emitted signal strongly depends on the sound chip used. To correctly determine the activity of the microphone, it was also necessary to solve the problem of filtering noise from other electrical circuits and take into account the change in the signal depending on the connection.
In the end, the researchers were able to adapt their device to reliably detect mic-on on 27 out of 30 tested laptop models from Lenovo, Fujitsu, Toshiba, Samsung, HP, Asus, and Dell. The three devices that the method didn't work with were the 2014, 2017, and 2019 Apple MacBook models (suggested that the signal leak could not be picked up due to the shielded aluminum case and the use of short flex cables).
The researchers also tried to adapt the method for other classes of devices, such as smartphones, tablets, smart speakers and USB cameras, but the efficiency turned out to be noticeably lower - out of 40 devices tested, only 21 were detected, which is explained by the use of analog microphones instead of digital, other circuits connection and shorter conductors emitting an electromagnetic signal.
Source: opennet.ru