Side Chan-delier Attack

Research from Ben-Gurion University describes a new tool for professional spies (and nosy Aunts), named Lamphone, that can reconstruct audio by observing slight vibrations in a hanging lightbulb. Lamphone works at long distances and can be constructed for less than $1,000. Perhaps most importantly, Lamphone is undetectable; it emits no signals and does not require the area under observation to be compromised in any way.

Speech, or other audio sources, create variations in air pressure on the surface of a lightbulb, which cause the light to vibrate. Lamphone works by focusing a telescope on this lightbulb. Attached to the telescope is an electro-optical sensor consisting of a photodiode that converts light into electrical currents. These electrical currents are then fed into an algorithm in the sound recovery system, running on a nearby laptop.

To create the sound recovery algorithm, the authors attached a gyroscope to the bottom of a hanging lightbulb. Sound waves were produced in close proximity to the lightbulb, and a Raspberry Pi 3 sampled measurements from the gyroscope. From this information, the authors were able to devise an algorithm capable of translating light vibration observations into audio.

This is not the first side-channel attack to target secondary effects of sound waves. The Laser Microphone device directs a laser at an object in the room to be surveilled, and modulations in the reflected laser beam are converted to audio. While this technique has long been popular, it can be detected, which gives the undetectable Lamphone technique an important advantage. Another existing method is called the Visual Microphone. The Visual Microphone captures high-speed camera footage of objects in a room and analyzes vibration patterns to extract audio. The method is effective, but requires expensive hardware and several hours of processing time to extract a few seconds of audio. Lamphone, on the other hand, is inexpensive and operates in real-time.

As is often the case with cutting edge technologies, there are some caveats and areas for improvement. Lamphone requires that a lightbulb in a hanging fixture be visible to the observer. Non-hanging lighting fixtures dampen vibrations too much to extract sound information. Also, any other factors that limit the vibration of the light (e.g. using a heavier bulb) can defeat Lamphone. The authors suggest that these limitations may be able to be overcome by using better equipment, and they are currently experimenting with extracting audio from other light sources.