TickTock: Detecting Microphone Status in Laptops Leveraging Electromagnetic Leakage of Clock Signals

TL;DR

TickTock is a novel system that detects whether a laptop microphone is active by analyzing electromagnetic signals from the circuitry, providing a new method to protect user privacy against remote microphone spying attacks.

Contribution

This paper introduces TickTock, the first system to externally detect laptop microphone status using electromagnetic leakage, addressing a gap in privacy protection methods.

Findings

Successfully detected mic status on 27 out of 30 laptops

Achieved high true positive and negative detection rates

Demonstrated feasibility with a proof-of-concept system

Abstract

We are witnessing a heightened surge in remote privacy attacks on laptop computers. These attacks often exploit malware to remotely gain access to webcams and microphones in order to spy on the victim users. While webcam attacks are somewhat defended with widely available commercial webcam privacy covers, unfortunately, there are no adequate solutions to thwart the attacks on mics despite recent industry efforts. As a first step towards defending against such attacks on laptop mics, we propose TickTock, a novel mic on/off status detection system. To achieve this, TickTock externally probes the electromagnetic (EM) emanations that stem from the connectors and cables of the laptop circuitry carrying mic clock signals. This is possible because the mic clock signals are only input during the mic recording state, causing resulting emanations. We design and implement a proof-of-concept system to demonstrate TickTock's feasibility. Furthermore, we comprehensively evaluate TickTock on a total of 30 popular laptops executing a variety of applications to successfully detect mic status in 27 laptops. Of these, TickTock consistently identifies mic recording with high true positive and negative rates.