Lamphone
Real-Time Passive Sound Recovery from Light Bulb Vibrations
Ben Nassi * Yaron Pirutin* Adi Shamir ** Yuval Elovici * Boris Zadov*
*Ben-Gurion University of the Negev **Weizmann Institute of Science
TLDR
We were able to recover speech and songs from 25 meters by capturing light
emitted from a hanging light bulb.
Abstract
In this paper, we introduce "Lamphone," an optical side-channel attack used to recover sound from desk lamp light bulbs; such lamps are commonly used in home offices, which became a primary work setting during the COVID-19 pandemic. We show how fluctuations in the air pressure on the surface of a light bulb, which occur in response to sound and cause the bulb to vibrate very slightly (a millidegree vibration), can be exploited by eavesdroppers to recover speech passively, externally, and using equipment that provides no indication regarding its application. We analyze a light bulb's response to sound via an electro-optical sensor and learn how to isolate the audio signal from the optical signal. We compare Lamphone to related methods presented in other studies and show that Lamphone can recover sound at high quality and lower volume levels than those methods. Finally, we show that eavesdroppers can apply Lamphone in order to recover speech at the sound level of a virtual meeting with fair intelligibility when the victim is sitting/working at a desk that contains a desk lamp with a light bulb from a distance of 35 meters.
Associated Publications
-
Lamphone: Passive Sound Recovery from a Desk Lamp's Light Bulb Vibrations (USENIX Sec'22)
-
Lamphone: Real-Time Passive Sound Recovery from Light Bulb Vibrations (IACR'20)
Sound Recovered From A Hanging Bulb
We recovered two songs and one sentence that were played via speakers in the office using optical measurements that were obtained from a single telescope.
Hear the recovered audio:
Talks
Media
Press
_svg.png){kind=logo}
FAQ
Q1: What is the difference between Lamphone and Visual Microphone?
Lamphone shows that high-resolution data obtained by the Visual Microphone (a case in which a sample is an RGB matrix) is not required when using a hanging light bulb. Instead, we show that an electro-optical sensor that outputs information at a lower resolution (a one-pixel sample) is sufficient to recover sound. As a result, Lamphone can be applied in real-time scenarios.
Q2: What is the difference between Lamphone and Laser Microphone?
A Laser Microphone device requires an eavesdropper to direct a laser beam into a victim's room. As a result, it can be detected using a dedicated optical sensor that analyzes the directed laser beams reflected off the objects. Lamphone is totally passive, so it cannot be detected using a dedicated optical sensor that analyzes the directed laser beams reflected off the objects.
Q3: What is the difference between Lamphone and other related works that used devices that were located in proximity to a victim to recover sound (e.g., Gyrophone, Hard Drive of Hearing)?
Such methods require that eavesdroppers find ways of compromising devices (placed in physical proximity of a target/victim) in order to: (1) obtain data that can be used to recover sound, and (2) exfiltrate the raw/processed data.
Lamphone is totally external, hence it does not require eavesdroppers to compromise a device.
Q4: How informative is the sound that can be recovered from the vibrations of a bulb?
We were able to recover speech that was accurately transcribed by Google's Speech to Text API. We were also able to recover singing that was recognized by Shazam.
Q5: What is the maximal range that you were able to recover sound from?
We were able to recover sound from 25 meters.
This range can be amplified with proper equipment (bigger telescope, 24/32 bit ADC, etc.)