Security researchers in China have unveiled a side-channel attack technique capable of intercepting internal audio played through headphones and landline phones from tens of meters away using injected electromagnetic signals, even through solid walls.

InjectEave attack allows hackers to recover audio playing on headphones from 30 meters - Image: InjectEave Project

Called InjectEave by a joint research team from the Hong Kong University of Science and Technology (Guangzhou) and the Hong Kong Polytechnic University, the finding could change how cybersecurity experts view physical EM vulnerabilities. Traditionally, passive EM attacks rely on eavesdropping on faint radiation emitted by microchips and analog components. However, low-frequency baseband signals, such as human speech audio operating between 10 Hz and 10 kHz, produce signals that naturally decay within a few inches, making EM interception impossible.

InjectEave bypasses the limitation by actively illuminating target hardware with a continuous-wave EM carrier signal transmitted via a directional radio-frequency antenna. When this carrier wave hits the internal circuitry of headphones, desk phones, or smart home appliances, it interacts directly with non-linear hardware components like audio amplifiers, operational amplifiers, and analog-to-digital converters.

The InjectEave process - Image: InjectEave Project

Furthermore, because these non-linear components now act as mixers (via a phenomenon known as active intermodulation distortion), they modulate the low-frequency audio signal, such as private speech playing through headphone drivers, onto the incoming radio carrier. The device's internal wiring and headphone cords then act as transmission antennas, re-radiating a modified, high-frequency radio signal back into the surrounding environment.

So an attacker positioned up to 30 meters away can capture these modulated sidebands using software-defined radio equipment and a spectrum analyzer. Since the non-linear mixing process introduces non-linear distortion into the reflected signal, the researchers incorporated a diffusion-based deep learning denoising model to reconstruct clean audio, making spoken content and speaker identity more recognizable.

During real-world experiments conducted in offices, hotels, and meeting rooms, the team demonstrated that InjectEave could successfully reconstruct intelligible audio from both wired and wireless headphones through barriers. The researchers/spy-wannabes also demonstrated that the technique could capture power consumption traces and control signals from smart devices like household lamps and fans to track physical room activity.

Due to the fact that the vulnerability taps into the fundamental physical properties of analog electronics, standard encryption methods offer no protection; only hardware-level shielding and filtering can suppress the EM injection process.