New technical surveillance attacks – EarSpy, what is it?
EarSpy evidences that the historic dance between the development of new technical surveillance attacks and the countermeasures, designed to mitigate these newly emerging attacks, never stops.
A group of researchers from some of America’s most reputed academic institutions have now developed an attack named EarSpy, designed to capture what users say through curiously crafty means.
What is EarSpy?
- EarSpy is a side-channel attack on Android phones.
- It uses motion sensors (like accelerometers) to pick up tiny vibrations caused by the ear speaker during phone calls.
- These sensors don’t usually require permissions, making them an attractive target.
What can EarSpy do?
Using machine learning, EarSpy can:
- Detect the speaker’s gender with very high accuracy.
- Identify the speaker’s identity under good conditions.
- Capture parts of speech content, though this is much less accurate and inconsistent.
Why it works now
- Modern phones have stronger ear speakers that produce more detectable vibrations.
- Motion sensors are now more sensitive than before.
- Existing protections, like sampling rate limits, don’t fully prevent the attack.
EarSpy Limitations
- Accuracy drops with background noise, low volume, user movement, or depending on the phone model.
- Full conversation reconstruction is unreliable — it’s better at detecting traits (like gender or identity) than actual spoken words.
- Hardware layout affects effectiveness, since sensor placement matters.
Mitigations
- Restrict or require permissions for apps accessing motion sensors.
- Reduce ear speaker volume during calls.
- Design phones with better vibration isolation or sensor placement.
- Newer Android versions already limit high-frequency sensor data access, which helps reduce risk.
Bottom line
EarSpy shows that even non-microphone sensors can be abused to leak private information. While it’s not yet practical for perfect eavesdropping in real life, it highlights a serious new privacy risk that device makers and OS developers need to address.
EarSpy can eavesdrop on your phone conversations using motion sensors (androidpolice.com)