EMPhone: Electromagnetic Covert Channel via Silent Audio Playback on Smartphones

Area of Science:

• Cybersecurity
• Mobile Device Security
• Information Theory

Background:

• Covert channels on smartphones present significant security risks.
• Previous methods for electromagnetic (EM) covert channels are ineffective on newer devices.
• Modern smartphones require novel approaches to detect and mitigate hidden communication.

Purpose of the Study:

• To implement and evaluate a novel end-to-end electromagnetic covert channel on Samsung Galaxy S21, S22, and S23 smartphones.
• To identify and exploit new signal generation methods for covert communication.
• To assess the reliability, robustness, and data rates of the developed EM covert channel.

Main Methods:

• Analysis of EM emissions in the 0.1-2.5 MHz range to identify volume-independent signals.
• Exploitation of hardware recovery delay after silent audio playback for signal generation.
• Development of a stealthy Android application, time-based modulation, and specialized demodulation techniques.
• Experimental validation of modulation time, probe distance, and message length.

Main Results:

• A novel EM covert channel was successfully implemented and evaluated on modern Samsung Galaxy smartphones.
• Consistent, volume-independent signals were generated by exploiting audio playback recovery delays.
• Maximum error-free bit rates of 0.558 bps (Galaxy S21) and 0.772 bps (Galaxy S22/S23) were achieved.
• Reliable communication was feasible up to 0.5 cm with a near-field probe, maintaining low bit error rates for 100-byte messages.

Conclusions:

• This research establishes a practical and significant security threat posed by EM covert channels on modern smartphones.
• The developed system demonstrates the feasibility of covert data transmission using subtle EM emissions.
• Countermeasures are proposed to mitigate this newly identified vulnerability in mobile devices.