Recently published research on computer security, aided by a Cornell Tech research assistant, suggests that sound transmitted by a computer can give would-be eavesdroppers a clue as to what is on the screen.
A team of researchers from Cornell Tech, the University of Michigan, the University of Pennsylvania and Tel Aviv University collaborated to produce new findings on what they call “acoustic leakage.”
Their report, entitled “Synesthesia: Detecting Screen Content via Remote Acoustic Side Channels,” claims that “subtle acoustic noises emanating from within computer screens can be used to detect the content displayed on the screens.”
Roei Schuster, a fourth-year Ph.D. student at Tel Aviv University and a research assistant at Cornell Tech specializing in cybersecurity, discussed the findings in a phone interview with The Sun.
Schuster told The Sun that public awareness about how closely screen display and sonic output are connected is very low, often a large problem among consumers who might not realize the connection.
“Computers have a lot of information on the screen, and it is not intuitive how that info can leak into acoustics,” Schuster said.
Eran Tromer, another participant in the research from Tel Aviv University and Columbia University, expanded on the implications of the conclusions in an article in Wired Magazine.
“I think there’s a lesson here about being attuned to the unexpected in our physical environment and understanding the physical mechanisms that are behind these gadgets that we use,” Tromer told Wired.
The inadvertent transmission of audio data is part of a broader cybersecurity realm that deals with “side channels,” a term for attacks that pick up on a computer’s electromagnetic emissions and power consumption rather than attempt to infiltrate through software weaknesses.
Sounds can be picked up by “ordinary microphones built into webcams or screens,” according to the report. Schuster explained that the audio can even give listeners enough information to determine visited websites and discern on-screen text.
“In terms of differentiating activities on the screen we can get very accurate,” he told The Sun.
The report notes that the accuracy of what acoustic leaks can reveal diminishes with distance from the source. The report does, however, outline ways that computer users make themselves unwittingly vulnerable with adjacent microphones such as webcams.
“Users commonly share audio recorded by these microphones, e.g., during voice-over IP and video-conference calls,” the report reads. “Users often make an effort to place their webcam (and thus, microphone) in close proximity to the screen, in order to maintain eye contact during video-conference, thereby offering high quality measurements to would-be attackers.”
The report briefly details potential mitigation strategies such as eliminating the noise leaks, masking them with other sound, absorbing them before they are picked up or utilizing internal software measures.
“Incorporating mitigations could raise screen price [of computers], so the practicality at the moment is not clear,” Schuster told The Sun.
Schuster indicated to The Sun that while the research into screen leakage is finished for now, his team is examining some preliminary “side channels.”