Researchers from Hong Kong have developed a method called InjectEave, which intercepts audio signals from analog components in headphones, wired phones, and smart devices. The technique uses an active electromagnetic carrier signal in the 0 to 9 MHz range to exploit non-linear components like amplifiers, ADCs, and MOSFET transistors.
The required hardware setup includes a USRP B210 software-defined radio, antennas, a Siglent SSA3075X Plus spectrum analyzer, and a laptop. An additional RF amplifier can be used to extend the range of the attack. The team tested the method on 11 commercially available devices to demonstrate its effectiveness.
During testing, the attack range reached 1 to 6 meters, extending up to 30 meters with an RF amplifier. The researchers demonstrated that the method works through walls, allowing for potential eavesdropping on conversations or monitoring smart home devices like fans and lamps by analyzing their power consumption and control signals.
The researchers note that standard protections such as encryption or signal randomization are ineffective against InjectEave because the vulnerability exists in the analog path. While shielding and filtering can reduce the risk by lowering the energy of the carrier signal, they do not provide complete protection.
