Full Report
Eve's dropping in on Alice and Bob
Analysis Summary
# Vulnerability: InjectEave - Active Electromagnetic Injection Eavesdropping
## CVE Details
- **CVE ID**: Not yet assigned (Research discovery)
- **CVSS Score**: N/A (Estimated High for Confidentiality impact)
- **CWE**: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor / CWE-513: Creation of Observed Electromagnetic Emissions
## Affected Systems
- **Products**: Wide range of analog and digital devices including wired/wireless headphones, VoIP landlines, and smart home appliances.
- **Versions**: Various commercial models (2014–2025).
- **Configurations**: Devices containing non-linear analog components (amplifiers, ADCs, power converters, MOSFETs) that lack sufficient electromagnetic shielding.
- **Tested Models**:
- **Headphones**: Sony ZX110AP, Apple Earbuds, UGreen MAX2, Philips TAH2020, HP H231R.
- **Landlines**: Flyingvoice P23GW (VoIP).
- **Smart Devices**: Xiaomi BPLDS10DM/1S, OIDIRE ODI-MF10A, JINGZAO JDO-06.
## Vulnerability Description
InjectEave is an active electromagnetic (EM) side-channel attack. Unlike passive sniffing, which often fails due to low signal-to-noise ratios, InjectEave injects a specific EM carrier signal (0-9 MHz range) into a target device.
This injected signal interacts with the device's **non-linear hardware components** (such as power converters or amplifiers). Through a process of hardware nonlinearity, the device's internal audio or control signals are modulated onto the injected carrier. This "up-converted" signal is then re-radiated, allowing an attacker to capture and demodulate the sensitive data from a distance.
## Exploitation
- **Status**: PoC available (Academic research presented at USENIX Security 2026).
- **Complexity**: Medium - Requires specialized RF knowledge and equipment.
- **Attack Vector**: Adjacent (Can penetrate walls; range up to 30 meters with amplification).
- **Required Equipment**:
- USRP B210 Software Defined Radio (SDR).
- Antennas for injection and reception.
- Spectrum analyzer (e.g., Siglent SSA3075X Plus).
- RF Power Amplifier (for extended range).
## Impact
- **Confidentiality**: High (Allows remote eavesdropping of private conversations and monitoring of smart home activity).
- **Integrity**: None (Read-only side-channel).
- **Availability**: None.
## Remediation
### Patches
- **Not Applicable**: As this is a hardware-level vulnerability involving the physics of analog components, software patches cannot resolve the flaw.
### Workarounds
- **Physical Shielding**: Using Faraday-style pouches for devices when not in use.
- **Hardware Modification**: Implementation of high-quality **shielding, filtering, and twisted-pair wiring** in device design to reduce EM coupling.
- **Distance**: Increasing physical distance between sensitive devices and common areas/external walls.
## Detection
- **Indicators of Compromise**: Presence of unexplained RF carrier signals in the 0-9 MHz range near sensitive areas.
- **Detection Methods**: Spectrum analysis to identify active injection signals that deviate from the normal RF environment.
## References
- **Project Site**: hxxps[://]injecteave[.]github[.]io/
- **Research Paper**: hxxps[://]injecteave[.]github[.]io/assets/paper/sec26cycle2-final651[.]pdf
- **USENIX Presentation**: hxxps[://]www[.]usenix[.]org/conference/usenixsecurity26/presentation/yan-haoran