Skip to content

QIF-T0094

high

Magnetometer speaker-leakage eavesdropping (magnetic field emanation capture from speaker voice coils)

Tier 3 — Demonstrated (Lab-proven)

Legacy status: DEMONSTRATED

Speaker voice coils are electromagnets — when driven by audio current, they produce proportional magnetic field emanations. Smartphone magnetometers (used for compass/navigation) are sensitive enough to detect these emanations from nearby speakers, earbuds, or headphones. Zhang et al. (2020) demonstrated that a smartphone's magnetometer placed within 10-20 cm of earbuds can reconstruct the audio being played, including speech. This creates an eavesdropping channel through magnetic emanations rather than acoustic leakage — it works even when the audio is not audible (noise-canceling headphones, low volume). Matyunin et al. (2019) showed that magnetometer data can also fingerprint websites and applications by their characteristic audio/vibration patterns. Magnetometer access requires no permission on most platforms, making this an unrestricted side channel.

Technique Details

Tactic
QIF-S.RP
Status
DEMONSTRATED
Bands
S1, S2, S3

Therapeutic Application

Smartphone magnetometer captures electromagnetic emanations from nearby speaker voice coils to reconstruct audio content without acoustic coupling

Neural Impact

3 of 7 neural bands affected

S1 S2 S3

Drag to rotate. Click a region to learn more.

Click or hover over a glowing region to see the attack techniques targeting it and their severity.

Scoring

NISS v1.1 NISS:1.1/BI:N/CR:N/CD:N/CV:E/RV:F/NP:N
CVSS v4.0 CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
1.4Low
BICRCDCVRVNP
 

Governance

Neurorights at Risk

This technique threatens 1 of the 4 proposed neurorights (Ienca & Andorno, 2017).

Consent Complexity
0.12 / 4.0

FDORA §3305 Compliance

Cyber Device
Regulatory Coverage
0.5 / 1.0
524B Requirements
TM VA SBOM SA PM
Regulatory Gaps
  • ! No FDA pathway for consumer sensor exploitation
  • ! Software-only attack without software lifecycle standard (IEC 62304)

Population Vulnerability

CRB vulnerability adjustment (γ=0.30) accounts for age, diagnosis severity, consent capacity, and device dependency.

Population NISS Base Adjusted Severity Delta
Adult (Default) 1.4 1.4 Low -
Child (10yr) + ADHD 1.4 1.6 Low +0.25
Adult with ALS 1.4 1.6 Low +0.23

Validation Status

Theoretical / Not yet validated. This technique has not been independently tested. See the validation dashboard for what has been tested.

Qinnovate Neural Security Atlas Edit this on GitHub