Researchers find way to listen in on headphones from afar

Researchers based in China have devised a way to eavesdrop on signals handled by analog components in devices such as headphones, landline handsets, and smart devices by injecting electromagnetic (EM) signals.

The technique, referred to as InjectEave, is not simply listening in on a low-frequency analog signal.

It's an EM side-channel attack that overcomes one of the longstanding barriers to exploiting EM leakage: the faintness of RF signals in devices like headphones makes it difficult for adversarial listeners to separate signal from noise.

Many different RF side-channel attacks have been explored, such as reading screen display emissions to reconstruct on-screen text or detecting the RF signals emitted by keys on a keyboard.

But these techniques often prove impractical for passive EM capture because of the low signal-to-noise ratio.

InjectEave trades passive signal capture for active signal manipulation.

By transmitting a signal in the 0-9 MHz range – specifics have been withheld – an attacker can potentially modulate an otherwise difficult-to-detect audio signal so it can be captured by nearby equipment.

"Our new project, InjectEave, shows that RF [radio frequency] signals can induce information leakage from everyday headphones, allowing an attacker to recover headphone audio from up to 30 meters away, including through walls," said Yan Long, assistant professor at The Hong Kong University of Science and Technology (HKUST) in Guangzhou, in an email to The Register.

"We have verified the new vulnerability on multiple commercial devices including devices from Sony, HP, Philips, etc." Long and HKUST co-authors Haoran Yan, Ziyu Shao, and Shuhao Zhang, along with Qinhong Jiang of The Hong Kong Polytechnic University, describe their work in a paper [PDF] titled "Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity," which was presented at USENIX Security 2026.

The attack targets non-linear components found in computer systems, such as amplifiers, analog-to-digital converters, power converters, and switching MOSFETs.

The interplay of the injected signals, the hardware, and the target audio signals essentially modulates the target signal so that it leaks and is detectable by the adversary.

Conducting an InjectEave attack requires commodity RF equipment: a USRP B210 software-defined radio; antennas for injection and reception; a Siglent SSA3075X Plus spectrum analyzer; a laptop for controlling the SDR; and optionally an RF power amplifier to increase attack range.

The researchers tested the technique with 11 off-the-shelf devices.

One obvious application would be espionage, allowing an attacker to listen in on conversations carried over headphones or a landline phone.