Researchers at five different universities have been working to identify and develop a new attack that targets Android users. To various degrees, the attack can recognize the caller’s gender and identity as well as discern private speech. This type of attack had been explored in the past using loudspeakers. In past attempts, the ear speaker embedded in the Android device was not of high enough quality to work, but progress in technology has allowed researchers to effectively craft an attack. The team also used the third-party app ‘Physics Toolbox Sensor Suite’ to capture accelerometer data during a simulated call and then fed it to MATLAB for analysis and to extract features from the audio stream. A machine learning tool was then created and trained to recognize speech content, caller identity, and gender.
Analyst Notes
Although this proof of concept (PoC) was crafted for academic proposes, it does establish that if an attacker were to trick a victim into downloading the right application, these types of data could be extracted from the victim’s phone calls. The researchers suggest that phone manufacturers should ensure sound pressure stays stable during calls and place the motion sensors in a position where internally originating vibrations are either leaving motion sensors unaffected, or at the least where sound vibrations would have the minimum possible impact.
https://www.bleepingcomputer.com/news/security/earspy-attack-eavesdrops-on-android-phones-via-motion-sensors/
