Skip to content
The methodOpen data
Back to the collection

Motion Sensor-based Privacy Attack on Smartphones

S Abhishek Anand, Chen Wang, Jian Liu, Nitesh Saxena, Yingying Chen

2019 · arXiv

Security & cryptographyPsychologyMachine learning
Read the paper
HN score
0
Mentions
3
Readers
3
Months
3
What’s in a score?

From the abstract

In this paper, we build a speech privacy attack that exploits speech reverberations generated from a smartphone's in-built loudspeaker captured via a zero-permission motion sensor (accelerometer). We design our attack Spearphone2, and demonstrate that speech reverberations from inbuilt loudspeakers, at an appropriate loudness, can impact the accelerometer, leaking sensitive information about the speech. In particular, we show that by exploiting the affected accelerometer readings and carefully selecting feature sets along with off-the-shelf machine learning techniques, Spearphone can successfully perform gender classification (accuracy over 90%) and speaker identification (accuracy over 80%) for any audio/video playback on the smartphone. Our results with testing the attack on a voice call and voice assistant response were also encouraging, showcasing the impact of the proposed attack. In addition, we perform speech recognition and speech reconstruction to extract more information about the eavesdropped speech to an extent. Our work brings to light a fundamental design vulnerability in many currently-deployed smartphones, which may put people's speech privacy at risk while using the smartphone in the loudspeaker mode during phone calls, media playback or voice assistant interactions.

Metadata: arXiv. Abstracts retain their original authors’ rights.

In the conversation

Original HN comments, with labels from simple text rules. A label describes the whole comment and may miss context or irony. Read the discussion to make up your own mind. About the labels

3 selected excerpts · 3 total mentions

throwaway29303
Neutral mention · rule
They may not be eavesdropping with the microphone but they could be with an accelerometer[0]. In particular, we show that by exploiting the affected accelerometer readings and carefully selecting feature sets along with off-the-shelf machine learning techniques, Spearphone can perform gender classification (accuracy over 90%) and speaker identification (accuracy over 80%) for the audio/video playback on the smartphone for our recorded dataset. Google was capable of warning people of an earthquake before it even happened[1]. Google has also turned individual phones into miniature earthquake sensors. All smartphones have accelerometers that can pick up signals of an…
Read the full comment
earthquake. If triggered, the phone sends the message to a detection server, along with rough location data, like the city a device is in. The server then pieces together where the earthquake is happening from data collected on multiple phones and beams out the relevant alerts. [0] - https://arxiv.org/abs/1907.05972 [1] - https://arstechnica.com/science/2022/10/how-google-alerted-c...
Original comment People Still Think Their Smart Speakers Are Eavesdropping on Conversations
wongarsu
Neutral mention · rule
So for context I looked at the papers behind the scenarios. - The heart rate sensing is done on a smart watch, not a phone, and needs data from the actual heart rate sensor every couple of days [1]. - The breathing rate is determined from a phone put on the breast or the abdomen [2]. Not really a threat vector in that form. - The audio stuff is incredibly impressive [3], but it doesn't look like they can reconstruct text with meaningful reliability, it's more about identifying the person or at least the gender of the person on the other end of the line. The location and activity detection scenarios seem the most credible to me, but the for targeted attacks the audio reconstruction might also work. The other two don't really seem credible to me yet, but good to be aware of them. 1: https://arxiv.org/pdf/1807.04667.pdf 2: http://www.ijetch.org/vol8/900-M302.pdf 3: https://arxiv.org/pdf/1907.05972.pdf
Original comment iPhone apps can tell many things about you through the accelerometer
tomasreimers
Neutral mention · rule
It's fascinating to me that gyroscope and accelerometer data don't seem to require permissions or explicit user opt-in on smartphones (at least that was true a few years ago and still seems true from a quick Google search, although I'm not sure if things have changed). As a side-channel, I've read about them being used for: - This. - Audio recordings of users (https://arxiv.org/pdf/1907.05972.pdf) - Keystrokes (https://medium.com/@tomasreimers/axolotl-a-keylogger-for-iph..., this one is shameless self-promotion and also why I'm interested in the topic) To me it seems that there are so few legitimate use-cases for device motion (mostly fitness related and https://www.cyberdefinitions.com/definitions/SMTH.html) that it's almost shocking you can access them by default.
Original comment Companies can track your phone’s movements to target ads

Keep following the thread.

More in Security & cryptography

More from the same topics.

2018arXiv

Talent vs Luck: the role of randomness in success and failure

A. Pluchino. A. E. Biondo, A. Rapisarda

The largely dominant meritocratic paradigm of highly competitive Western cultures is rooted on the belief that success is due mainly, if not exclusively, to personal qualities such as talent, intelligence, skills, efforts or risk taking.

Psychology
16 mentions14 months
2.5HN score