High-frequency audio could be used to stealthily track netizens
Technical folks looking to improve web privacy haven't been able to decide whether sound beyond the range of human hearing poses enough of a privacy risk to merit restriction.
People can generally hear audio frequencies ranging from 20 Hz and 20,000 Hz, though individual hearing ranges vary. Audio frequencies below and above the threshold of human hearing are known as infrasound and ultrasound, respectively.
[...] A warning from America's trade watchdog, the FTC, in 2016 and research published the following year identifying 234 Android apps listening covertly for ultrasound beacons, helped discourage inaudible tracking.
Several of the companies called out for these privacy-invading practices, such as SilverPush, have moved on to other sorts of services. But the ability to craft code that communicates silently with mobile devices through inaudible sound remains a possibility, both for native apps and web apps. Computer security researchers continue to find novel ways to use inaudible audio for data exfiltration. And ultrasound is still used for legitimate operations – Google's Cast app, for example, relies on an ultrasonic token when pairing with a nearby Chromecast.
[...] Weiler raised the subject three weeks ago – one element in a larger debate about reducing the fingerprinting surface of the Web Audio API. And last week, the discussion thread was closed by Raymond Toy, a Google software engineer and co-chair of the W3C's Audio Working Group.
Toy argued that if a developer is allowed to use a specific audio sampling rate, no additional permission should be required – few users enjoy dealing with permission prompts, after all. And other web developers participating in the debate expressed concern that limiting available frequency ranges could introduce phase shifting or latency and that there's no sensible lower or upper threshold suitable for everyone.
Related Stories
Bunnie Huang has published a reference design for a near-ultrasound data link.
We were requested to investigate “near ultrasound” (NUS) links as part of our research on developing the Simmel reference design for a privacy-preserving COVID-19 contact tracing device. After a month of poking at it, the TL;DR is that, as suspected, the physics of NUS is not conducive to reliable contact tracing. While BLE has the problem that you have too many false positive contacts, NUS has the problem of too many false negatives: pockets, purses, and your own body can effectively block the signal.
That being said, we did develop a pretty decent-performing NUS data link, so we’ve packed up what we did into an open source reference design that you can clone and use in your own projects.
Previously:
(2020) Your Apps Can Pick Up Ultrasonic Signals You Can't Hear
(2017) Ultrasound Tracking Could be Used to Deanonymize Tor Users
(Score: 4, Funny) by MostCynical on Sunday May 10 2020, @11:44PM (3 children)
why stop apps being developed for beluga whales, porpoises and bats, just 'cause humans can't hear it? [wagthedoguk.com]
Just because someone can make a computer respond to those frequencies, and possibly spy on you or control your devices without your knowledge is no reason to deny species with better hearing their apps!
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
(Score: 1) by Ethanol-fueled on Sunday May 10 2020, @11:55PM (1 child)
It started from a Chinese app that was designed to attract bats for bat soup by emitting ultrasonic chirps. Later, the Jews, having been working in concert with the Chinese to subvert Western government and culture, put their heads together with the Chinese scientists to make money from the concept. Thus, ultrasonic ad-tracking was born.
(Score: 3, Funny) by Anonymous Coward on Monday May 11 2020, @12:11AM
Yes but it's only currently used by the CCP, Mossad & 5 eyes to gangstalk jmichaelhudson
(Score: 2) by krishnoid on Monday May 11 2020, @02:40AM
I bet you could teach a dog to alert when it hears something outside the human audible range. Or ... if certain elements are already doing so, in order to serve and protect.
(Score: 2) by Runaway1956 on Monday May 11 2020, @12:29AM (9 children)
Phone makers can surely design speakers that only respond to human audible sound? If the sensitivity of the speakers are restricted, the apps mean nothing.
Alternative für Deutschland
(Score: 1) by Ethanol-fueled on Monday May 11 2020, @12:52AM (8 children)
You'd need to put a low-pass filter with a steep-as-fuck rolloff behind your sensor (microphone). So that's a multi-stage low pass filter with multiple resonant sections. Still easy to do with a custom-purpose IC or a discrete network of RLC components. Perhaps some junior or senior-level academic training in Signals and Systems. Maybe you could do a bandpass filter with a wide Q but with steep rolloffs on both sides using the same principles. But for paranoid home use, you'd have to utilize a tap or sniffer along with a spectrograph.
(Score: 0) by Anonymous Coward on Monday May 11 2020, @01:02AM (7 children)
Why are you doing it in hardware? GSM has a sample rate of 8kHz based on early work by Bell that found an upper frequency 3.5kHz was enough for voice transmission. A "voice only" restriction option for audio input at the OS level could downsample and prevent all the potential attacks under discussion.
(Score: 2) by Kell on Monday May 11 2020, @01:18AM (1 child)
But if it's done in software it's subvertible by updating the filter to allow wider frequencies. The point of putting it into hardware is that you have to physically access the unit to change it, which is impractical for large numbers of people.
Scientists ask questions. Engineers solve problems.
(Score: 0) by Anonymous Coward on Monday May 11 2020, @01:46AM
We're discussing cross device and general web-audio fingerprinting. A user may want to enable full frequency for skype calls with their family but restrict for zoom meetings with Satan and their other colleagues.
(Score: 0) by Anonymous Coward on Monday May 11 2020, @01:25AM (1 child)
Because I want battery life more than a couple of hours?
(Score: 0) by Anonymous Coward on Monday May 11 2020, @01:38AM
When you make downsampled cell calls or when you compress 6 times the sample data for transmission over webaudio?
(Score: 0) by Anonymous Coward on Monday May 11 2020, @01:57AM
And as long as you don't care about everybody being able to talk, it isn't an issue. Phone systems don't properly allow Chinese through and I've had issues with voice menu systems because they filter my voice out.
Still, there is a point beyond which apps shouldn't be able to record without specific permission. Few users would allow it as there's usually nothing in it for them.
(Score: 3, Interesting) by Snotnose on Monday May 11 2020, @02:22AM
I was working for Qualcomm circa '96 when they introduced a new vocoder that gave better voice quality at the same bitrate. The problem? The pauses in normal conversation, for which this vocoder gave silence, made people think the connection had dropped so they hung up. The solution? When nobody was saying anything add some noise.
Being the dumbest idiot in the land and president of the US should be 2 different people.
(Score: 2) by sjames on Monday May 11 2020, @04:23PM
People listen to music and watch video on their phone too, so you'll need more than 8KHz. Software restrictions can be subverted with more software, but a hardware filter can only be hacked in person with a soldering iron.
Another advantage of the hardware approach is that you could filter the speaker but not the headphone).
(Score: 2, Interesting) by Anonymous Coward on Monday May 11 2020, @12:42AM (5 children)
The notes on a piano. Maybe subtract 1 octave on each end. But those 88 keys seem the define the "normal" audio ranges and been defined for decades if not for centuries.
Daughters use to use the "inaudible" ring tones on the phones. Big way to keep your phone on in the school in since teachers "cannot hear" the ringing. They got caught, found that I could hear it (more like "felt it" - like the dentist's ultrasonic teeth cleaner or a drill going into behind my ears). They did not think adults could hear that high.
My hearing also upset office, that installed a "white noise" generator to make it "quieter" in the office. That had to turned off from the pain it is was causing... even with me wearing eye-plugs. Also everyone was talking louder to be heard over the background noise. Confused them, when I sent them transcripts of phone calls from 8 cues away.
(Score: 0) by Anonymous Coward on Monday May 11 2020, @11:03AM (4 children)
There was this department store in the same town as where I went to university to study electrical engineering.
There was also a big department store in town that would not turn off their ultrasonic burglar alarm during the day. The women were very sensitive to it, and to them, it just made them feel nauseous, uneasy, and headaches if they did not leave. I could hear it too, and I knew what it was. Affected me like fixing a TV with an early horizontal output transformer whose ferrite core was quite magnetostrictive.
I recognized what it was, even tried to let the store know what was going on, and all I got was assurances that the alarm was off. Like hell it was. That thing was sounding off like an ultrasonic jewelry cleaner.
I can no longer hear ultrasonic cleaners. They just seem to hiss. Same with computer SMPS power supplies. I no longer hear them as a tone, now they feel like a pressure in the head...like when I am in the descent phase of a jet plane travel.
I note the department store, which tried to cater mostly to women, is no longer there, and I still wonder if that burglar alarm ran enough young people out of the store.
(Score: 0) by Anonymous Coward on Monday May 11 2020, @03:24PM (1 child)
That could be a good deterrent for youths who congregate to beat people up outside of McDonalds stores.
Could be worth looking in to.
(Score: 2) by sjames on Monday May 11 2020, @04:31PM
Of course, it would also make McDonalds unpopular with children. I doubt they want that. They could lose a whole generation of customers.
(Score: 2) by DannyB on Monday May 11 2020, @05:04PM (1 child)
Since I was a teen I could hear ultrasonic sounds from CRT TVs.
About 30 years ago, about the time of Gulf War 1, I was telling my wife this. So we tried an experiment. I went in a different room. She turned the TV volume all the way down. Then would ask me whether the TV was on or off. I could always tell each time she asked. She was amazed. But she could not hear it.
In about 1971 I was at a friend's house. Most people did not (at that time) have, but they had an ultrasonic TV remote. Each time they used it, it clearly bothered their dog. I could hear it. And I suddenly realized that it was astonishingly loud, but high pitched. More of a feeling than a sound.
I have doubts I could hear this today. (But no CRT TVs or ultrasonic remotes seem easily accessible to try.)
Revolver, or semi automatic modified to be fully automatic -- which is best for senior citizens in their porch swings?
(Score: 0) by Anonymous Coward on Monday May 11 2020, @09:03PM
I agree on the hiss sounds. I turned 61 this year, I can "hear" patterns on LCD and LED screens. Not that the panel is making the noice but the power circuits "buzzing" with the power spikes needed to make those patterns.
There was articale a few days ago, the air-gap computers can send information via the power supplies... I believe it.