A Fly on the Wall -- Exploiting Acoustic Side-Channels in Differential Pressure Sensors

TL;DR

This paper reveals that differential pressure sensors are vulnerable to acoustic side-channel attacks, enabling speech reconstruction from pressure readings, which raises privacy concerns and suggests new security challenges.

Contribution

The study uncovers a novel acoustic leakage vulnerability in differential pressure sensors and introduces BaroVox, a method to reconstruct speech from sensor data using signal processing and deep learning.

Findings

BaroVox achieves a 0.29 word error rate in speech recognition.

The attack attains 90.51% accuracy in keyword classification.

Differential pressure sensors can leak acoustic information affecting privacy.

Abstract

Differential Pressure Sensors are widely deployed to monitor critical environments. However, our research unveils a previously overlooked vulnerability: their high sensitivity to pressure variations makes them susceptible to acoustic side-channel attacks. We demonstrate that the pressure-sensing diaphragms in DPS can inadvertently capture subtle air vibrations caused by speech, which propagate through the sensor's components and affect the pressure readings. Exploiting this discovery, we introduce BaroVox, a novel attack that reconstructs speech from DPS readings, effectively turning DPS into a "fly on the wall." We model the effect of sound on DPS, exploring the limits and challenges of acoustic leakage. To overcome these challenges, we propose two solutions: a signal-processing approach using a unique spectral subtraction method and a deep learning-based approach for keyword classification. Evaluations under various conditions demonstrate BaroVox's effectiveness, achieving a word error rate of 0.29 for manual recognition and 90.51% accuracy for automatic recognition. Our findings highlight the significant privacy implications of this vulnerability. We also discuss potential defense strategies to mitigate the risks posed by BaroVox.