Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity
Researchers introduce InjectEave, using electromagnetic injection and hardware nonlinearity to induce side-channel leakage and eavesdrop on headphone audio from 30 meters.
An arXiv paper shows electromagnetic injection can actively amplify side-channel leakage: nonlinear hardware such as amplifiers, ADCs, and power converters modulates secret electrical signals onto an injected EM carrier, upconverting low-frequency secrets into measurable EM emissions. By tuning injection frequency and amplitude, an adversary can shape the effective spectrum and entropy of the resulting leakage. The InjectEave attack demonstrated eavesdropping on wired and wireless headphone audio from up to 30 meters and in through-wall scenarios using accessible RF equipment, plus leakage of smart home device power consumption and analog sensor inputs. Case studies show closed-loop eavesdropping and manipulation of landline phone conversations, and the paper discusses mitigations.
- Ubiquitous amplifiers, ADCs, and power converters act as unintentional modulators of secrets.
- Injection frequency and amplitude tune the leakage spectrum and entropy.
- Demonstrated through-wall operation and attacks on landline calls; mitigations analyzed.
Full article193 words · extracted from arxiv.org · click to collapse
Electromagnetic (EM) side-channel leakage and injection are typically treated as distinct physical phenomena, threatening data confidentiality and integrity respectively. This work investigates how EM injection can be used to amplify side-channel leakage that is otherwise infeasible. We introduce a novel framework for Injection-Induced EM Side Channels to enable integrated, closed-loop EM security analysis. Our theoretical modeling and experimental measurements reveal that nonlinear hardware components, such as ubiquitous amplifiers, analog-to-digital converters, and power converters, can modulate secret electrical signals onto an injected EM carrier and thus upconvert low-frequency secrets into measurable EM emissions. By tuning the injection frequency and amplitude, adversaries gain the ability to actively shape the effective spectrum and entropy of the resulting leakage. We design InjectEave attack and demonstrate eavesdropping on the audio played through wired and wireless headphones from up to 30 m away with accessible RF equipment, as well as in through-wall scenarios, and characterize injection-induced EM leakage of other low-frequency secrets such as power consumption of smart home devices and analog sensor inputs. Case studies further demonstrate how the proposed techniques enable closed-loop eavesdropping and manipulation of landline-phone conversations. Finally, we analyze the broader security challenges and mitigations.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.04785