Lamphone: Real-Time Passive Reconstruction of Speech Using Light Emitted from Lamps

Overview: Ben Nassi presents Lamphone, an optical side-channel attack capable of real-time, passive sound recovery by observing minute vibrations on the surface of a hanging light bulb. The research addresses acoustic eavesdropping limitations by bridging the gap between passive but computationally slow visual microphones and real-time but detectable laser microphones. The presentation outlines the physical principles of sound-induced bulb vibrations, evaluates existing acoustic recovery techniques, and demonstrates how optical sensors paired with a telescope can reconstruct speech remotely.

Key Topics: - Principles of physical eavesdropping and acoustic micro-vibrations on physical objects. - Classification of sound recovery methods into internal (malware-based) and external categories. - Comparative analysis between active laser microphones and high-speed visual microphones. - Threat modeling and experimental validation of the Lamphone optical eavesdropping attack.

Technical Details: Physical eavesdropping exploits acoustic pressure waves—propagating air vibrations between 20 Hz and 20 kHz—striking proximate physical objects. Traditional sound recovery approaches fall into internal or external categories. Internal methods leverage motion sensors, accelerometers, vibration motors, smartphone speakers, or magnetic hard drive read heads within a target space; while these sensors are often permissionless on modern operating systems, they necessitate compromising the host device with malware to exfiltrate data. Conversely, external methods do not require local malware execution. The classic laser microphone recovers sound in real time by bouncing a laser beam off a reflective surface, but its active optical emissions make it detectable by optical sensors. Alternatively, the visual microphone developed at MIT uses a high-speed camera (capturing 2,000 frames per second) to analyze passive vibrations of objects such as a bag of chips, but requires immense computational overhead, requiring hours of processing to recover a few seconds of audio and preventing real-time monitoring.

Lamphone resolves these trade-offs by functioning as an external, completely passive, and real-time acoustic recovery system. The attack model assumes an optical line of sight to a hanging light bulb in a target room where sound waves induce microscopic surface vibrations. The attacker aligns an electro-optical sensor (a photodiode converting light into voltage) mounted to a telescope focused on the hanging bulb. Fluctuations in emitted light intensity caused by physical bulb motion are captured, digitized through an analog-to-digital converter (ADC/A2D), and processed through a dedicated sound recovery algorithm to generate an acoustic signal (SNDStar). In baseline validation experiments, the researchers attached a physical gyroscope sampled at 800 Hz using a Raspberry Pi 3 to the base of a hanging light bulb, exposing it to varying sound volumes from nearby speakers to quantify vibration thresholds.

Key Takeaways: Lamphone demonstrates that standard hanging light bulbs inadvertently act as acoustic transducers and diaphragms, enabling passive eavesdropping over optical distances without active laser emissions or local device compromise. Defensive countermeasures include physical and architectural controls, such as replacing hanging light fixtures with fixed ceiling-mounted lights or heavier enclosures that resist acoustic vibrations. Facilities handling sensitive discussions should install window coverings, blinds, or optical baffles to eliminate external direct line of sight to interior bulbs and lighting elements.

(AI summary — Gemini Flash)