LeakyPick: IoT Audio Spy Detector

TL;DR

LeakyPick is a low-cost device that detects unauthorized audio streaming from IoT devices in smart homes, enhancing user privacy by identifying unexpected audio transmissions with high accuracy.

Contribution

We introduce LeakyPick, a novel, cost-effective system that detects unauthorized audio transmissions from IoT devices in real homes, with a prototype built on Raspberry Pi achieving 94% accuracy.

Findings

Achieved 94% detection accuracy for audio transmissions

Identified 89 misinterpreted wake-words causing unintended transmissions

Demonstrated cost-effective monitoring for consumer privacy

Abstract

Manufacturers of smart home Internet of Things (IoT) devices are increasingly adding voice assistant and audio monitoring features to a wide range of devices including smart speakers, televisions, thermostats, security systems, and doorbells. Consequently, many of these devices are equipped with microphones, raising significant privacy concerns: users may not always be aware of when audio recordings are sent to the cloud, or who may gain access to the recordings. In this paper, we present the LeakyPick architecture that enables the detection of the smart home devices that stream recorded audio to the Internet without the user's consent. Our proof-of-concept is a LeakyPick device that is placed in a user's smart home and periodically "probes" other devices in its environment and monitors the subsequent network traffic for statistical patterns that indicate audio transmission. Our prototype is built on a Raspberry Pi for less than USD40 and has a measurement accuracy of 94% in detecting audio transmissions for a collection of 8 devices with voice assistant capabilities. Furthermore, we used LeakyPick to identify 89 words that an Amazon Echo Dot misinterprets as its wake-word, resulting in unexpected audio transmission. LeakyPick provides a cost effective approach for regular consumers to monitor their homes for unexpected audio transmissions to the cloud.