QIF-T0076

Haptic motor body sonar (taptic engine repurposing for tissue impedance profiling)

A phone's haptic actuator (e.g., Apple Taptic Engine, linear resonant actuator) is driven at known frequencies (100 Hz - 5 kHz sweep) while in contact with the body. The built-in accelerometer and/or microphone measures the tissue response: acoustic impedance varies by tissue type (bone, muscle, fat, fluid), depth, and composition. This is a simplified form of acoustic impedance spectroscopy or elastography using consumer hardware. The technique requires: (1) physical contact between device and body (phone against skin), (2) firmware-level or jailbreak access to drive the haptic motor at arbitrary frequencies (consumer APIs limit haptic patterns), and (3) raw accelerometer access at high sample rates. Potential extractions: body composition estimation, subcutaneous fluid detection (edema), bone density approximation, tissue stiffness changes. This is significantly lower resolution than clinical ultrasound elastography but could distinguish gross tissue categories. The attack surface is narrow (requires physical contact + firmware access), but wearable devices (Apple Watch, fitness bands) that maintain constant skin contact and contain both haptic motors and accelerometers present an always-on version of this attack.