How your phone, fitness band vibration motors can be hacked for eavesdropping
In the Samsung Galaxy S3, a simple wire connected the vibra-motor's output and the audio line-in port.
Besides buzzing to alert you to calls, texts, and alarms, a phone's vibration motor can also function as a solid speech sensor, researchers have demonstrated.
And that means one more potential method for spies to eavesdrop on phone conversations, Nirupam Roy and Romit Roy Choudhury from the University of Illinois at Urbana-Champaign argue in a paper detailing their VibraPhone, a system designed to recover and distill words from currents transmitted by vibration motor circuits.
"We show that the vibrating mass inside the motor, designed to oscillate to changing magnetic fields, also responds to air vibrations from nearby sounds," the pair write.
That the motor did respond to sound wasn't surprising but they didn't expect it could be used to reproduce audible speech and thus act as a kind of microphone.
Besides eavesdropping, the researchers argue it could be used to enable voice control on devices that don't have a microphone, such as fitness trackers, and could be a fairly low overhead on battery power since it operates in passive mode.
To record speech sounds from the vibration motor, the VibraPhone exploits the concept of "reverse electromagnetic force" in electronic circuits. As ambient sound hits the vibrating mass, it sends a reverse current to the circuit, which the researchers record and then use to "distill" human speech.
"Briefly, the A/C current in the vibra-motor creates a changing magnetic field around a coil, which in turn causes the vibra-motor mass to vibrate. However, when an external force impinges on the same mass, say, due to the pressure of ambient sound, it causes additional motion, translating into a current in the opposite direction," they explain.
The researchers have been able to recover spoken words from this reverse current and then use VibraPhone to process it into audible speech. Before processing, a word such as "often" is muffled, but after post-processing it is comparable to a word captured by a microphone. They provide several examples of this phenomenon.
However, it seems unlikely the vibration motor on a phone is a realistic attack scenario just yet.
For the experiment, the researchers cracked open a Samsung Galaxy S3 and wired the vibration motor to the audio line-in port. They then collected sound from earphone jack.
The rewiring part is "trivial", they said, and could be done in 10 minutes. However, since the vibration motor is not connected to an analog-to-digital converter (ADC), it can't act as a microphone.
Still, the researchers have been able to demonstrate that they can decode words from a noisy, low-bandwidth signal.
They will be presenting their paper at MobiSys 2016 conference in Singapore, which begins on June 25.