New InjectEave Attack Lets Hackers Eavesdrop on Headphone Audio From 30 Meters Away

Security researchers have unveiled InjectEave, an electromagnetic side-channel attack that can turn ordinary headphones into unintended transmitters.

By directing radio-frequency energy at vulnerable hardware and collecting the resulting emissions, an attacker can reconstruct audio playing through a target device.

In a long-range experiment using amplified equipment, researchers successfully recovered audible speech from wireless headphones at distances of up to 30 meters.

New InjectEave Attack

InjectEave is different from conventional Bluetooth interception because it does not require pairing with the headphones, compromising the victim’s phone, accessing a Wi-Fi network, or placing a microphone nearby.

Instead, it targets analog circuitry, particularly amplifiers, audio paths, and connecting wires, that can respond nonlinearly when exposed to carefully selected electromagnetic signals.

The underlying phenomenon is called an injection-induced electromagnetic side channel. The attacker directs a single-frequency carrier towards the device.

Nonlinear components in the target mix interact with the analog signal, for example, when speech is driven through headphone drivers.

This interaction produces modulated electromagnetic leakage, which a receiving antenna and spectrum-analysis equipment can capture. The leakage is then demodulated and processed to recover the original audio content.

The research team evaluated 11 commercial products across five categories: wired headphones, wireless headphones, a VoIP desk phone, smart fans, and smart lamps.

In a lower-power configuration, tested wireless headphone models enabled effective eavesdropping distances of 4 to 6 meters. Wired headphones were also found to be vulnerable. However, their susceptibility depended partly on the audio circuitry of the connected host device.

For the 30-meter demonstration, researchers increased transmission power using an external amplifier. However, this result should not be taken as a universal attack range, as performance can vary based on target hardware, audio amplitude, antenna geometry, receiver sensitivity, electromagnetic noise, and physical obstacles.

The paper notes a signal-to-noise degradation of approximately 45 dB as distance increased from 10 cm to five meters. Nevertheless, materials such as glass, wood, and concrete had a limited impact on the evaluated scenarios, allowing successful proof-of-concept through-wall eavesdropping in controlled hotel-room and meeting-room settings.

Signal reconstruction is a vital aspect of the attack. Hardware nonlinearity introduces harmonics and distortion that can obscure speech.

Therefore, InjectEave employs a score-based generative speech-enhancement model trained on synthesized distorted audio. In one headset test, the post-processing stage improved the average signal-to-noise ratio from 7.0 dB to 16.1 dB.

It raised the Short-Time Objective Intelligibility metric from 0.58 to 0.72. In a real-world scenario, researchers measured a word error rate of about 22 percent at a playback level of 65 dB.

The work also extends beyond passive surveillance. In a separate demonstration against a Flyingvoice VoIP landline, researchers outlined an “eavesdrop-synthesize-inject” chain: recovering call audio, generating a voice-cloned response triggered by specific words, and then injecting the synthesized speech into the device’s audio path.

Although this was demonstrated only on researcher-controlled equipment, it highlights how electromagnetic vulnerabilities could jeopardize both confidentiality and audio integrity.

Defending against InjectEave is primarily a hardware security challenge. Conventional software measures for digital side channels, such as masking and clock randomization, do not protect continuous analog waveforms.

The researchers from Arxiv recommend implementing stronger electromagnetic shielding, filtering, and differential signaling, as well as detecting anomalous RF carriers or DC offsets.

Their teardown and simulation work also found that twisted-pair wiring reduced measured leakage by 10.7 dB compared to parallel wires in a test setup. Manufacturers should assess analog interfaces early in the design process, and organizations handling sensitive calls should consider unshielded consumer audio equipment as a potential physical-layer risk.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.