👂 Your phone really could be listening to you or being spied on!

You probably already know that hackers can break into computer webcams and see everything they capture. With the right malware and a little luck, these attacks can also let them control the camera and take photos, as well as record video and sound. It is a frightening scenario that has affected thousands of people over recent years.

😮 Spied on through your computer's microphone

Protecting yourself against this kind of attack is relatively simple: just put a little tape over the camera when you are not using your computer. When it comes to the microphone, though... it is not so easy. And that could be a serious problem.

You might think the webcam is the main concern, but a well-placed microphone is the key to a clever new technique that hackers could use, one that sounds straight out of a spy film or science fiction. Researchers recently discovered how to spy on a computer screen remotely by listening with a sound-recording device.

Think this makes no sense, since screens are meant to be looked at? How exactly can someone hear what electronic images show?

It is possible through a phenomenon called coil whine. Coil whine is typically a high-pitched sound that electronic components produce when working under load. Old televisions and monitors are known for making this noise, but today's high-tech LCDs do it too.

This group of cybersecurity researchers found that they could pick up these sounds with a microphone. The raw data the team collected seems worthless, as it only represents the intensity of pixels on the screen. But this is just the first part of the attack.

A carefully programmed machine using machine-learning algorithms was able to interpret the recordings. With the help of other software, the group successfully identified the websites being viewed on the computer with 96.5% accuracy.

Of course, nobody knows whether hackers will start using this technique or when, especially since there are simpler ways to spy on someone's computer activity. Still, this attack has potential, particularly because we all have smart microphones at home connected, for example, to surveillance equipment.

😩 Your phone really could be listening to you

Puzzled by the way adverts appeared after he had discussed a particular subject, an Australian journalist from Vice decided to investigate the mystery behind these advertising campaigns.

In a report published in June, the reporter describes something unusual that happened a few years earlier, while he was in a bar with a friend, their iPhones in their pockets. They were discussing recent trips to Japan and how much they wanted to return. A day later, both friends started being bombarded with adverts for flights to Tokyo on Facebook. At first, they thought it was just a huge coincidence. Yet many people tell exactly the same story, making it seem as though their phones really are listening to their conversations. Paranoia or reality?

According to Peter Henway, a senior consultant at cybersecurity company Asterix and a former lecturer and researcher at Edith Cowan University, our phones can indeed listen to us, but not in the sinister way we might imagine.

First, for our phones to be prompted to listen to a conversation, there has to be a trigger: one or more words that initiate that action, as when we activate Siri or Google.

That may not be cause for alarm, but if third-party apps such as Facebook are installed on the phone, this data can be accessed without the action that starts recording. Whether the information is then used is unknown.

Sounds sent to third-party servers

Henway explained in an interview that audio snippets are known to be sent frequently to the servers of apps we all have installed on our smartphones. However, the digital security professional says the triggers that cause these recordings are unknown.

“Time, location and the use of certain functions”, the expert says, are accessed by apps using their microphone permissions. “But this data is sent in encrypted form, so it is very difficult to identify the exact trigger.”

Peter Henway also says that apps such as Facebook or Instagram could have thousands of different triggers. Even an ordinary conversation about buying sugar to bake a cake could be enough to activate them. Although this technology is known to exist, some companies, such as Facebook, categorically deny listening to users' conversations.

The former lecturer believes that, just as Google openly says it uses these practices, other companies do too. Henway also says he sees no reason why they would not: it benefits marketing, and user agreements and legislation allow it. “I assume they are doing it; there is just no way for us to be certain,” he says.

The experiment: talking to a phone

With all this in mind, the journalist decided to run an experiment. Twice a day for five days, he said phrases or words that could, in theory, act as triggers. For example: “I want to take another course” and “I need cheap shirts for work”. Afterwards, he carefully monitored all the paid adverts on Facebook to try to establish a connection.

"The journalist says he had never seen this advert for quality clothing in his Facebook feed until he told his phone he needed shirts"

The reporter insists that the changes were extremely quick. He suddenly started receiving information about courses starting outside the usual intake period at several colleges, and more affordable clothing brands. In addition, after talking to a friend about how quickly he was using up his mobile data, adverts for 20GB mobile internet plans began appearing. The journalist says that, although the offers were good, the experience of talking to his phone was a warning sign.

Of course, no company is selling our data to third parties or advertising companies, since the strict GDPR rules do not allow it, but the truth is that our information may not be completely protected. Today, we know that these companies do not need this kind of data to target us with adverts. What happens now is that the companies we give information to do not tell partners they have lists of people who might interest them. Instead, they say that, in exchange for money, they will let those people see their adverts. If it became public that we were being listened to, for example, these large companies would lose their exclusive access to that information. Hence the complete secrecy surrounding the subject.

Henway also insists that the fact tech companies value our data does not mean they protect it from government agencies. As most of these companies are based in the United States of America, the NSA and perhaps the CIA may have access to our information, even if that would be illegal in Portugal.

A real threat?

In practice, we assume our phones really are listening to us and that anything we say near them could be used against us. Of course, some people, such as journalists or lawyers, may face other dangers because of their work.

Still, even if you are an ordinary person leading a normal daily life and chatting to friends about trips to Japan, it is frightening to think that advertisers or companies selling advertising space might know the substance of those private conversations. This is even worse than advertisers snooping on browser histories.

For Peter Henway, this is an extension of what used to happen with television. But rather than focusing on prime-time audiences, companies now monitor online habits. Despite this, the expert believes this scenario does not pose a threat to most people, even if it is not entirely ethical.