1. Presented by: Chen Shi 02/22/2018
BackDoor: Making Microphones Hear Inaudible Sounds Nirupam Roy, Haitham Hassanieh, Romit Roy Choudhury University of Illinois at Urbana-Champaign
Presented by: Chen Shi
02/22/2018

2. Overview
Record high frequency inaudible sound with regular microphone utilizing its hardware non-linearity
“BackDoor” System
RF Receiver

3. Microphone System Sound Recording Signal Flow
Anti-aliasing Low-pass Filter

4. Non-linearity Linear Amplifier: Sout = A1Sin
Nonlinear Behavior: Sout = A1Sin + A2Sin2 + A3Sin3 + …
For example, Sin = S1 + S2 = Sin(2πf1t) + Sin(2πf2t)
Sout = A1(S1 + S2) + A2(S1 + S2)2 = Cos(2π(f1 - f2)t) + …
A 10kHz “shadow” recordable signal produced

5. Validation Microphone shows sensitivity at high frequencies
High enough second order non-linear coefficient

6. System Design - Data Communication
Transmitter – Speaker | Receiver – Microphone
Transmitter Design
Amplitude Modulation (AM) Fails
On the microphone side, SAM = aSin(2πfmt)Sin(2πfct)
Sout2 = A2SAM2 = … + cos(2π2fmt)
2fm detectable by microphone for fm < 10kHz
However, speaker presents the same non-linearity, making message signal audible

7. System Design - Data Communication
Transmitter Design
Frequency Modulation (FM)
SFM = Sin(2πfct + bSin(2πfmt))
Sout2 = … + (1 + Cos(2π2fc) + …), speaker output not audible
However, microphone cannot record 2fc
Second carrier fs from second speaker to down-convert
SFMRx = A1(SFM + Sin(2πfst)); square SFMRx results in a fc – fs term
fc = 40kHz & fs = 50kHz
Best response
Microphone resonance

8. System Design - Data Communication
Transmitter Design
Ringing effect of speaker: heavy-tailed impulse response
Non-linearity produces low frequency signals - slightly audible
Inverse filtering
Pre-code input
Smod = h-1 * SFM
Sout = SFM
No ringing

9. System Design - Data Communication
Receiver Design
Unmodified microphone
Decode input signal
Bandpass filtering according to modulation bandwidth
Hilbert transform to remove negative frequencies
Multiply the resulting signal with a complex signal to bring the spectrum to baseband
Differentiate its phase to obtain data bits

10. System Design - Jamming to prevent recording
Passive Gain Suppression
Automatic gain control (AGC) in microphone: adjust gain level corresponding to sound amplitude to fit within the ADC range
Jamming by inserting ultrasound tones to lower AGC gain and suppressing the audible voice signals

11. System Design - Jamming
Active Frequency Distortion
Jamming by adding strong white noise to reduce SNR
[40Hkz, 52kHz] band-limited Gaussian noise modulated with 52kHz carrier to down-convert to [0, 12kHz]
Even better: shape the white noise signal with high power in frequencies important for voice

12. Evaluation - Test Setup
Transmitter: (1) Communication (2) Jamming
Receiver:(1 ) Samsung Galaxy S6 (2) Hacked MEMS Microphone

13. Evaluation - Human audibility
7 users around the speakers report levels of audible sounds
Single Tone Unmodulated Signals
Frequency Modulated Signals
Amplitude Modulated Signals
White Noise Signals
BackDoor inaudible to all the users for all types of signals at all SNR levels except amplitude modulation

14. Evaluation - Data Communication
High throughput compared to other acoustic comm. systems
Package error rate influenced by phone orientation at Y/-Y

15. Evaluation - Data Communication
Bit error rate variations against interference sources
Voice and music - minimal impact
White noise – degrade performance by affecting the operating frequencies of BackDoor at ~10kHz

16. Evaluation - Jamming Efficacy
Shaped Jamming Signal
White Noise Jamming Signal

17. Discussions Jamming range – ultrasound attenuation in air
Speaker array to increase power level & multiple jammers
Limitation in jamming with multiple microphone
Data communication influenced by phone calls
Interesting idea & well organized & clearly presented
Setup could be improved & experiments could be more comprehensive and generally applicable
Do we really need all these if we can afford a low-cost ultrasound receiver?