Researchers find a way to snoop on you through your phone’s vibration motor

Cover up your webcam, disable microphone access and put on your tinfoil hat — but it won’t make any difference, because the Illuminati can get at you through your phone’s vibration motor now. Well, kind of, anyway. Your best defense? Talk in a high voice.

The “VibraPhone” research comes from Romit Roy Choudhury and Nirupam Roy, associate professor and PhD candidate, respectively, at the Electrical and Computer Engineering school of the University of Illinois at Ubana-Champaign.

It’s a surprisingly simple idea, really: A vibration motor is really like a tiny speaker. And every speaker can be a microphone. Think about it.

Okay, if it’s not obvious — a magnetic surface that has its position controlled by an applied voltage can also be arranged so that its own position changes that voltage instead. One way it’s a speaker, the other way it’s a microphone.


LRA motor diagram courtesy of Precision Microdrives.

So it’s not “fundamentally surprising” that the vibration motor could be used to pick up sounds, the two wrote in their paper (PDF), which will be presented later this month at MobiSys in Singapore. But “the fidelity to which this is possible has been somewhat unexpected.”

First though, it should be made clear that this attack can’t be executed over the air or anything. The motor has to be physically rewired, although it’s a simple enough job and could be done in a minute or two. A less invasive technique is conceivable, though. “It may be possible to exploit the power controller chip to collect the voltage fluctuation in the vibration motor,” Roy wrote in an email to TechCrunch. “However, we did not investigate this possibility.”

Furthermore, only Linear Resonant Actuator (LRA) vibration motors were tested — while many cheaper and older devices use Eccentric Rotating Mass (ERM) motors, which spin a weight to create a vibrating motion, and would be “less susceptible to this attack,” Roy wrote.

At any rate, once the reconfiguration is done, the vibration motor begins turning the vibrations it encounters into voltage variations, which Roy and Choudhury showed can be reconstructed into waveforms.

Of course, microphones tend to make for bad speakers, and vice versa — to say nothing of a device that was only ever meant to buzz. Doug Roberts, of Precision Microdrives, which makes LRA motors among other things, wrote me to say “it’s very impressive that the researchers were able to pick out speech.” Despite the LRAs’ superficial resemblance to speakers, they’re really quite unsuitable for the task, due to having “very high Q factors.” (Checks out, but I had to check Wikipedia.)

The limitations of rigging up this tiny thing as a mic appear instantly: The frequencies captured are only on the low end of the spectrum, petering off around 2 kHz. However, comparison of original spectrograms to recovered ones allowed the researchers to create a process for guessing what higher frequencies should be present, and the result is… well, still not great.

But we’re not recording an album here, and even in this degraded state the sounds can still be recognized by humans and voice recognition algorithms with decent accuracy: people got them 80 percent of the time, naive voice rec 60 percent. And this is just a proof of concept — others could come along and vastly improve performance.

For now, though, the researchers confirmed that “If the voice does not contain enough low frequency sound to capture, the performance of the system will degrade.” So the way to foil this vulnerability is to talk in a high voice all the time. Go ahead, and let your friends laugh. You will be comforted by your security. (This will actually only kind of work, though — even high notes from sopranos tend to be below 2 kHz.)

Is someone going to sneak into your house, steal your phone, quietly disassemble it, rewire it and then listen to garbled audio of you asking Siri for recipes? No, but that’s not the only attack vector. Devices like fitness bands or smartwatches, many of which lack microphones, still have vibration motors that are, perhaps, more enticing targets, because no one thinks to carefully monitor what they say around their step tracker.

In the meantime, the researchers aren’t going any deeper in the intrusive direction; instead, and I for one applaud them for it, they are looking into more constructive applications.

“We are rather exploring if similar techniques can help us to recover speech from the subtle vibration of vocal cords, facial bones or skull,” Roy wrote. “If possible, it can be useful to develop an assistive system for persons with speech impairment.”

I look forward to further research on the topic. You can read more about it and listen to voice samples at the VibraPhone site.