Presented by: Chen Shi 02/22/2018 BackDoor: Making Microphones Hear Inaudible Sounds Nirupam Roy, Haitham Hassanieh, Romit Roy Choudhury University of Illinois at Urbana-Champaign Presented by: Chen Shi 02/22/2018

Overview Record high frequency inaudible sound with regular microphone utilizing its hardware non-linearity “BackDoor” System RF Receiver

Microphone System Sound Recording Signal Flow Anti-aliasing Low-pass Filter

Non-linearity Linear Amplifier: Sout = A1Sin Nonlinear Behavior: Sout = A1Sin + A2Sin2 + A3Sin3 + … For example, Sin = S1 + S2 = Sin(2πf1t) + Sin(2πf2t) Sout = A1(S1 + S2) + A2(S1 + S2)2 = Cos(2π(f1 - f2)t) + … A 10kHz “shadow” recordable signal produced

Validation Microphone shows sensitivity at high frequencies High enough second order non-linear coefficient

System Design - Data Communication Transmitter – Speaker | Receiver – Microphone Transmitter Design Amplitude Modulation (AM) Fails On the microphone side, SAM = aSin(2πfmt)Sin(2πfct) Sout2 = A2SAM2 = … + cos(2π2fmt) 2fm detectable by microphone for fm < 10kHz However, speaker presents the same non-linearity, making message signal audible

System Design - Data Communication Transmitter Design Frequency Modulation (FM) SFM = Sin(2πfct + bSin(2πfmt)) Sout2 = … + (1 + Cos(2π2fc) + …), speaker output not audible However, microphone cannot record 2fc Second carrier fs from second speaker to down-convert SFMRx = A1(SFM + Sin(2πfst)); square SFMRx results in a fc – fs term fc = 40kHz & fs = 50kHz Best response Microphone resonance

System Design - Data Communication Transmitter Design Ringing effect of speaker: heavy-tailed impulse response Non-linearity produces low frequency signals - slightly audible Inverse filtering Pre-code input Smod = h-1 * SFM Sout = SFM No ringing

System Design - Data Communication Receiver Design Unmodified microphone Decode input signal Bandpass filtering according to modulation bandwidth Hilbert transform to remove negative frequencies Multiply the resulting signal with a complex signal to bring the spectrum to baseband Differentiate its phase to obtain data bits

System Design - Jamming to prevent recording Passive Gain Suppression Automatic gain control (AGC) in microphone: adjust gain level corresponding to sound amplitude to fit within the ADC range Jamming by inserting ultrasound tones to lower AGC gain and suppressing the audible voice signals

System Design - Jamming Active Frequency Distortion Jamming by adding strong white noise to reduce SNR [40Hkz, 52kHz] band-limited Gaussian noise modulated with 52kHz carrier to down-convert to [0, 12kHz] Even better: shape the white noise signal with high power in frequencies important for voice

Evaluation - Test Setup Transmitter: (1) Communication (2) Jamming Receiver:(1 ) Samsung Galaxy S6 (2) Hacked MEMS Microphone

Evaluation - Human audibility 7 users around the speakers report levels of audible sounds Single Tone Unmodulated Signals Frequency Modulated Signals Amplitude Modulated Signals White Noise Signals BackDoor inaudible to all the users for all types of signals at all SNR levels except amplitude modulation

Evaluation - Data Communication High throughput compared to other acoustic comm. systems Package error rate influenced by phone orientation at Y/-Y

Evaluation - Data Communication Bit error rate variations against interference sources Voice and music - minimal impact White noise – degrade performance by affecting the operating frequencies of BackDoor at ~10kHz

Evaluation - Jamming Efficacy Shaped Jamming Signal White Noise Jamming Signal

Discussions Jamming range – ultrasound attenuation in air Speaker array to increase power level & multiple jammers Limitation in jamming with multiple microphone Data communication influenced by phone calls Interesting idea & well organized & clearly presented Setup could be improved & experiments could be more comprehensive and generally applicable Do we really need all these if we can afford a low-cost ultrasound receiver?