How your mouse could eavesdrop and rat you out

"The mouse sitting next to you can be turned into a microphone thanks to some cunning use of its sensors to pick up vibrations from your voice in an attack dubbed Mic-E-Mouse. Researchers at UC Irvine have found that optical mice equipped with 20,000 DPI sensors and decent latency can be used as a basic microphone with software designed to figure out speech patterns based on the vibration of the user's voice. The team used a $35 mouse to test the system and found it could capture speech with 61 percent accuracy, depending on voice frequency."

""The main two parameters we look at in the mouse are the sampling rate and the DPI," Dr Halima Bouzidi told The Register. "And it's capable of picking up more than just speech. If there's anyone in the room and their steps are causing vibrations, you can track their movement.""

"For the attack to work, a miscreant must first infect the computer - but they don't need especially advanced malware. Security software usually protects mouse data less rigorously than it does core system functions. This allows attackers to exfiltrate it relatively easily, and all it takes is one malicious app - possibly disguised as open source software - that uses mouse data."

"Once they collect the data, researchers run it through a Wiener filter to remove noise and then feed it into a transformer-based neural network to identify actual words. Numbers are particularly easy to detect, which will be worrying for those reading out their credit card details to a vendor, for example."

Optical mice with high DPI and sufficient sampling rates can detect vibrations from nearby speech and convert them into usable audio data. A 20,000 DPI mouse on a flat surface captured speech with roughly 61 percent accuracy depending on voice frequency. Captured sensor traces are denoised with a Wiener filter and analyzed by a transformer-based neural network to identify words, with numbers particularly easy to detect. The same vibration signals can also reveal footsteps and other movements. The attack requires malware on the host to access mouse data, and performance degrades with mats, covers, or noisy environments. Vulnerable manufacturers were notified under responsible disclosure.

Read at Theregister