The security community has reported that a new malicious tactic has been developed called the Synesthesia Side Channel Attack. The available information shows that inaudible acoustic signals can be deciphered into revealing sensitive user content. Several attack scenarios are proposed as this is merely another side channel attack that can be exploited by criminals.
Synesthesia Side Channel Attack Allows Hackers To “Listen To” On-Screen Images
A group of researchers from Columbia University, the University of Michigan, University of Pennsylvania and Tel Aviv University reveal a new side channel attack called “Synesthesia”.The dangerous approach relies on the fact that recorded inaudible acoustic noises coming in from the computer (device) screens can be deciphered into reading the displayed content. The discovery shows that there is a wide range of possibilities for acquiring the requested information — via smartphone microphones, webcams, laptop mics, portable gear and etc.
There are several attack scenarios that are initially proposed:
- Employer Surveillance — HR staff and employers can use this “silent” technique in order to view what content employees view on their computers. This replaces traditional approaches such as the installation of remote desktop tools.
- Data Theft — Attackers using various recording gear can spy on a single or multiple users by deciphering the acquired samples.
- Data Transmission — The collected audio sample recordings can be recorded by a malicious user and transmitted to a hacker that will process them.
The exact nature of the signals is that they are almost inaudible to the human ear — they are very faint and particularly high-pitched which cannot be deciphered using natural recognition technology. However during careful instrumental measurement it was discovered that the displayed content particular patterns when showing certain content. In short an attack model can be established on the basis of how the contemporary displays work — each displayed pixel is divided into a color region (red, green or blue). Effectively each color can be represented using 24-bit integers.
Other variables such as the screen’s refresh rate that are important can also be recorded. The change of state of displays emit a unique acoustic signal. A reverse engineering of the recorded samples can allow malicious users to recreate the on-screen actions. Tests were conducted in a production environment showing how a practical Synesthesia Side Channel Attack can be made. A recording device was placed near a screen to capture the screen leakage. Its analysis reveals that the displayed content can be effectively reconstructed by the hackers.
In addition to manual attacks hackers can also use voice assistants as Google Home and Amazon Alexa. Their always-on recording capability can be abused as they are meant to listen in to the client’s ambiance and process them onto the service’s cloud servers. A malicious user can retrieve the file transfer and use the captured data to run the Synesthesia Side Channel Attack. Machine learning can also be implemented in more complex approaches allowing criminals to harvest data of many users at once in an automated way.
For more information interested readers can directly read the paper online.
Martin Beltov
Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.
Follow Me: