Researchers from the Hong Kong University of Science and Technology (Guangzhou) and the Hong Kong Polytechnic University have developed InjectEave, a side-channel attack technique. It allows for the recovery of audio content from headphones from a distance of up to 30 meters, even through walls, without compromising Bluetooth or network security.
Unlike passive methods, InjectEave uses an active strategy by emitting radio signals in the 0 to 9 MHz range toward the target. These signals interact with non-linear components like amplifiers and converters, causing the device to emit modulated electromagnetic radiation that can be captured and demodulated by the attacker.
The team tested 11 commercial products, including wired and wireless headphones from Sony, Apple, HP, and Philips, as well as VoIP phones and smart home devices. While most devices were vulnerable at distances over 2 meters, the maximum range of 30 meters was achieved using an additional radio frequency power amplifier.
The setup requires only commercially available hardware, such as the USRP B210 software-defined radio, an antenna, a spectrum analyzer, and a laptop. Because the attack exploits physical characteristics of analog circuits rather than software vulnerabilities, encryption protocols do not prevent the data leakage.
The researchers presented their findings at the USENIX Security 2026 conference. They noted that while the 30-meter range is an experimental best-case scenario, the vulnerability persists through materials like glass, wood, and concrete, prompting calls for better hardware shielding and circuit design in future electronics.
