Gyrophone: Eavesdropping Using a Gyroscope

on YouTube ↗49m

" summary

Claim: phone gyroscopes pick up acoustic vibrations so apps or webpages that need no mic permission can eavesdrop. Experimental setup uses speakers and a phone, TI Digits corpus, MFCC and spectrogram features, SVM/GMM and dynamic time warping, plus preprocessing (upsample, silence removal). OS limits sampling to 200 Hz on Android and 100 Hz on iOS (hardware can do ~8 kHz); aliasing yields usable info. Results: 84% gender ID, single-device speaker ID up to 65% and isolated-word 26% speaker-independent (65% speaker-dependent), two devices reach 77%. Proposed defenses: OS/hardware low‑pass or permissioned high-rate access.

AI-written summary · about

" chapters (32)

1. 0:00Intro
2. 0:54INTRODUCTION - YAN MICHALEVSKY
3. 2:51MICROPHONE ACCESS
4. 4:56GYROSCOPE ACCESS BY A BROWSER JAVASCRIPT CODE EXAMPLE
5. 5:18MEMS GYROSCOPES
6. 7:41GYROSCOPES ARE SUSCEPTIBLE TO SOUND
7. 9:18GYROSCOPES ARE (LOUSY, BUT STILL) MICROPHONES
8. 11:46SOFTWARE LIMITATION OF THE SAMPLING RATE
9. 12:13SAMPLING FREQUENCY LIMITS
10. 14:19THE EFFECTS OF LOW SAMPLING FREQUENCY SPEECH SAMPLED AT 8,000HZ
11. 17:35WE CAN SENSE HIGH FREQUENCY SIGNALS DUE TO ALIASING
12. 18:53EXPERIMENTAL SETUP
13. 20:03SPEECH ANALYSIS USING A SINGLE GYROSCOPE
14. 23:04PREPROCESSING • All samples are converted to audio files in WAV format
15. 24:16FEATURES • MFCC-Mel-Frequency Cepstral Coefficients • Statistical features are used mean and variance
16. 26:27CLASSIFIERS
17. 27:37DYNAMIC TIME WARPING
18. 28:58GENDER IDENTIFICATION
19. 29:30WE CAN SUCCESSFULLY IDENTIFY GENDER
20. 30:17SPEAKER IDENTIFICATION
21. 30:51A GOOD CHANCE TO IDENTIFY THE SPEAKER
22. 31:54ISOLATED WORDS RECOGNITION SPEAKER INDEPENDENT
23. 34:54HOW CAN WE LEVERAGE EAVESDROPPING SIMULTANEOUSLY ON TWO DEVICES?
24. 36:10SIMILAR TO TIME-INTERLEAVED ADC's
25. 37:25NON-UNIFORM RECONSTRUCTION REQUIRES KNOWING PRECISE TIME-SKEWS
26. 40:43PRACTICAL COMPROMISE Interleaving samples from multiple devices
27. 41:15EVALUATION Tested for the case of speaker dependent word recognition
28. 42:15FURTHER ATTACKS
29. 43:26AMBIENT SOUND RECOGNITION
30. 44:05SOFTWARE DEFENSES
31. 45:15HARDWARE DEFENSES
32. 46:09CONCLUSION

" related talks

• 45mAnalogy Cyber Security—From 0101 to Mixed SignalsWenyuan Xu · USENIX Security '18
• 06mAudio Keyword Reconstruction from On-Device Motion Sensor Signals via Neural Frequency UnfoldingJinyang Li, Tianshi Wang, Shuochao Yao, Shengzhong Liu, Dongxin Liu, Huajie Shao, Ruijie Wang, Tarek Abdelzaher · UbiComp 2021
• 21mInjected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial SensorsYazhou Tu · USENIX Security '18
• 06mVocalLock: Sensing Vocal Tract for Passphrase-Independent User Authentication Leveraging ...Yan Wang, Li Lu, Jiadi Yu, Yingying Chen · UbiComp / ISWC 2020
• 06mVoice In Ear: Spoofing-Resistant and Passphrase-Independent Body Sound AuthenticationYincheng Jin, Yang Gao, Jiyang Li, Seokmin Choi, Jagmohan Chauhan, Zhangpeng Jin · UbiComp 2021
• 30mHidden Voice CommandsNicholas Carlini, Pratyush Mishra, Micah Sherr, David Wagner, Tavish Vaidya, Yuankai Zhang, Clay Shields, Wenchao Zhou · USENIX Security '16
• 06mListen to Your Fingers: User Authentication based on Geometry Biometrics of Touch GestureYu Wang, Wan Du, Fan Li, Huijie Chen, Song Yang, Matthew Conn · UbiComp / ISWC 2020
• 06mEarDynamic: An Ear Canal Deformation Based Continuous User Authentication Using In-Ear WearablesZi Wang, Zhi Wang, Sheng Tan, Linghan Zhang, Yili Ren, Jie Yang · UbiComp 2021