Spy vs. Spy

A modern study of mic bugs operation and detection

Veronica Valeros
@verovaleros

Sebastian Garcia

@eldracote

MatesLab Hackerspace

bit.ly/Spy34c3

Audio eavesdropping is a threat 

Audio eavesdropping is a threat 

A brief tour through the last century FM mic bugs

History: The Thing

History: The Thing

History: KGB bug

History: TI-574A

History: TI-574A

History: OPEC

Mic Technology Advances

From lasers to malware

Mic Technology Advances

From lasers in the air to malware

Lets Experiment!

FM and GSM commercially-available wireless stationary microphone bugs

F908

Frequency: 113.5MHz

Range: 500m  

 Battery: 9v

Price: 33 USD

MicroSpy

Frequency: 102MHz

Range: 500m  

 Battery: 9v

Price: 15 USD

Ear-1

Frequency: 102.2MHz

Range: 500m  

 Battery: 9v

Price: 18 USD

Beurer BY04

Frequency:
864MHz

Range:
800m  

 Battery:
3x AAA

Price:

65 USD

Mini A8

Frequency: EU GSM

Range: world-wide

 Battery: li-ion 3v

Price: 9.29 USD

Comparison

Listening Experiments

Listening Experiments

No need for a van in front of your house

Listening Experiments

Geolocation Remarks

  • Attackers need to be close

    • Good for you, filters your attackers

    • ​Bad for them, they need to be close

    • Bad for you, they are close

  • Nobody can help from the Internet

    • ​Bad for you

Autonomy Validation

Comparison with Malware

  • A successful malware infection is not guaranteed

  • Malware leaves traces. Others can find the attack.

  • People from the Internet can help with Malware

Comparison with non commercial

  • Battery vs. electricity

  • Transmit vs. storage

  • One-time conversation vs. all the time

  • One time access vs. continuous access

Contact a company if you are in a life-threatening situation. 

Salamandra

 

SDR-based, free software detection and location of hidden microphones

 

https://github.com/eldraco/Salamandra

USB SDR device

DVB-T+DAB+FM

Normal FM Radio Station

Mic F908

Mic F908

Detection Feature

  • Trained thresholds with ~85 experiments

  • Fixed the thresholds for the best detection

Location Feature

Salamandra new features

  • Detect and locate microphones

  • You can use rtl_power to record and send the signal to others with Salamandra

  • Profile your environment in different times and compare

Real Life Experiments

Experiments Methodology

  1. Seeker goes out. Hider hides mic (or not)

  2. Seeker gets in. Speaks passwords. Hider tries to catch them

  3. Measure time to detection

  4. Measure time to location

  5. Measure recall: (passwords heard / total passwords)

Real Life Experiments

Real Life Experiments

Real Life Experiments

Real Life Experiments

Experiments Conclusions

  • Hiding is hard

    • Power, behavior, know your target, physical access

  • Location is hard

  • Listening is hard

  • Detection is fast (w/Salamandra) 

Audio Improvements

Original

Improved

Music doesn't help so much these days. Be more creative!

Contributions

  • Systematic research on mic usage and performance

  • First sdr-based mic detection tool

  • First real-life experiments for comparison

Conclusions

  • Audio eavesdropping is a real threat. Don't be fooled.

  • Now you know how it works.

  • Now you know how to protect yourself.

 

Try Salamandra, find mics.

Advance the field. Help others.

Questions?

Veronica Valeros

@verovaleros

vero.valeros@gmail.com

Sebastian Garcia @eldracote

eldraco@gmail.com