Researchers Create TickTock Device to Detect Eavesdropping

Experts from the National University of Singapore and Yonsei University have developed a device called TickTock, which can check whether the microphone on a laptop or smartphone is being secretly used to record conversations. The device is currently built on a Raspberry Pi 4 Model B, but the team plans to make it resemble a regular USB flash drive in the future.

The gadget and its development process are detailed in a document published on ArXiv. The authors note that remote “spy” attacks are becoming more common. While there are already protective measures for webcams (or you can always cover the camera with tape, as Mark Zuckerberg does), there are no similar barriers to prevent eavesdropping through microphones.

The document states that recently, laptop manufacturers have tried to make microphone activation more obvious to users and harder for malware to exploit. For example, Apple devices now have a hardware disconnect for the microphone, designed to block it when the lid is closed. In 2020, Dell added Linux drivers to enhance privacy for microphones and cameras. Windows 10 and macOS 12 feature visible indicators when the microphone is active, and Purism has even built a hardware switch for the microphone and camera into its privacy-focused Librem 5 USA smartphone.

However, the researchers point out several shortcomings with these approaches:

• First, these solutions require users to trust laptop or operating system manufacturers, which have been hacked in the past, and sometimes even act with malicious intent themselves.
• Second, such solutions are only built into a small fraction of devices, so most modern laptops have no way to detect or prevent eavesdropping.

The TickTock prototype consists of near-field sensors, an RF amplifier, SDR, and a Raspberry Pi 4 Model B. The final version is expected to look more like a USB flash drive that can be placed next to or attached to a laptop, allowing the device to alert users to any changes in the microphone’s status.

How TickTock Works

TickTock operates on a simple principle: MEMS microphones in standard laptops emit electromagnetic signals when they are active. The emissions come from cables and connectors that transmit clock signals to the microphone hardware, ultimately operating the analog-to-digital converter. TickTock detects these leaks to determine whether the laptop’s microphone is on or off.

During development, the researchers faced several challenges:

• The clock signal frequency varies depending on the audio codec chip in each laptop.
• The area of the laptop emitting the strongest EM signal depends on the model and configuration.
• Not all captured EM signals indicate microphone activity; some may come from other circuits, so filtering is needed to prevent false positives.

Because of these factors, TickTock worked well with about 90% of the laptops tested (including various Lenovo, Dell, HP, and Asus models), but it could not detect microphone activity on three Apple MacBook laptops. The aluminum cases and short flexible cables in Apple devices reduce electromagnetic leakage to the point where TickTock cannot detect it.

The team also tested TickTock on 40 other devices, including smartphones, tablets, smart speakers, and USB webcams. The gadget was able to detect microphone activity on 21 out of 40 devices. The high failure rate is likely due to the use of analog rather than digital microphones in some smartphones, and the fact that smaller devices often use shorter wires, which reduces electromagnetic emissions.

Future Plans

In the future, the researchers plan to expand TickTock’s functionality so it can also detect unauthorized access to cameras and inertial sensor units.