Researchers from the Hong Kong University of Science and Technology and the Hong Kong Polytechnic University have developed InjectEave, a side-channel attack technique. It involves injecting radio signals into electronic devices to induce information leakage from analog circuits, enabling the interception of audio and other data.
Unlike traditional passive electromagnetic attacks that struggle with weak low-frequency signals, InjectEave uses an active approach. Attackers emit signals between 0 MHz and 9 MHz, which interact with non-linear components like amplifiers and converters. This process modulates the internal signals, allowing nearby radio equipment to capture and reconstruct the data.
The team tested 11 commercial products, including wired headphones from Sony, Apple, Ugreen, Philips, and HP, as well as smart fans from Xiaomi and Oidire. Most tests succeeded at distances exceeding 2 meters. With an RF power amplifier, researchers achieved successful audio recovery from up to 30 meters away.
The experimental setup included a USRP B210 software-defined radio, antennas, and a Siglent SSA3075X Plus spectrum analyzer. Tests were conducted in realistic scenarios, such as hiding devices behind walls or inside furniture, confirming that the attack does not require a controlled laboratory environment.
Experts note that because InjectEave exploits hardware-level vulnerabilities, traditional digital security measures are ineffective. Manufacturers are advised to implement electromagnetic shielding, filtering, and twisted-pair wiring to mitigate risks, though these methods do not guarantee complete protection.
