New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission

guest · Jul 17, 2019

New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission
July 17, 2019
https://thehackernews.com/2019/07/android-side-channel-attacks.html

Now, a separate team of cybersecurity researchers has successfully demonstrated a new side-channel attack that could allow malicious apps to eavesdrop on the voice coming out of your smartphone's loudspeakers without requiring any device permission.
Abusing Android Accelerometer to Capture Loudspeaker Data
Dubbed Spearphone, the newly demonstrated attack takes advantage of a hardware-based motion sensor, called an accelerometer, which comes built into most Android devices and can be unrestrictedly accessed by any app installed on a device even with zero permissions.

Besides this, Spearphone attack can also be used to simply determine some other user's speech characteristics, including gender classification, with over 90% accuracy, and speaker identification, with over 80% accuracy.

"For example, an attacker can learn if a particular individual (a person of interest under surveillance by law enforcement) was in contact with the phone owner at a given time," the researchers say.
The paper also discussed some possible mitigation techniques that may help prevent such attacks, as well as a few limitations, including low sampling rate and variation in maximum volume and voice quality of different phone that could negatively impact the accelerometer readings.
Click to expand...

Spearphone: A Speech Privacy Exploit via Accelerometer-Sensed Reverberations from Smartphone Loudspeakers
– How using the smartphone in speakerphone mode erodes your privacy –
(PDF - 3.93 MB): https://arxiv.org/pdf/1907.05972.pdf

Log in or Sign up

New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission

guest Guest

Log in or Sign up

New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission

guest Guest

Useful Searches