Mouse could eavesdrop on you and rat you out

The mouse sitting next to you can be turned into a microphone thanks to some cunning use of its sensors to pick up vibrations from your voice in an attack dubbed Mic-E-Mouse.

Researchers at UC Irvine have found that optical mice equipped with 20,000 DPI sensors and decent latency can be used as a basic microphone with software designed to figure out speech patterns based on the vibration of the user's voice. The team used a $35 mouse to test the system and found it could capture speech with 61 percent accuracy, depending on voice frequency.

"The main two parameters we look at in the mouse are the sampling rate and the DPI," Mohamad Fakih told The Register. "And it's capable of picking up more than just speech. If there's anyone in the room and their steps are causing vibrations, you can track their movement."

For the attack to work, a miscreant must first infect the computer – but they don't need especially advanced malware. Security software usually protects mouse data less rigorously than it does core system functions. This allows attackers to exfiltrate it relatively easily, and all it takes is one malicious app – possibly disguised as open source software – that uses mouse data.

• Don't want drive-by Ollama attackers snooping on your local chats? Patch now
• Logitech's MX Master 4 mouse buzzes with haptic feedback but lacks lefty love
• FBI cyber cop: Salt Typhoon pwned 'nearly every American'
• Stalkerware firm gets scooped by SQL-slinging security snoop

Once they collect the data, researchers run it through a Wiener filter to remove noise and then feed it into a transformer-based neural network to identify actual words. Numbers are particularly easy to detect, which will be worrying for those reading out their credit card details to a vendor, for example. You can see it in action below.

YouTube Video

There are some limitations. To record optimally, users must place the mouse on a flat, clear surface. A mouse mat or desk cover reduces the mouse's ability to collect voice data, and noisy offices or nearby machinery can also make snooping much harder.

But it's a novel attack and one that the team is trying to fix. Under responsible disclosure rules, the researchers informed 26 vulnerable mouse manufacturers, which are now developing a workaround to safeguard sensor data.

Fakih said the mouse might even be able to detect keystrokes. Because each key sounds different, researchers could potentially identify what someone is typing based on vibrations the nearby mouse detects, even while someone is using it.

"If the hand movements don't completely overpower the mouse vibrations, you can run a low-pass filter," he said. "Of course, there is some signal degradation there but you can still probably recover some data."

The UC Irvine team has spent more than a decade developing smart side-channel attacks, and this mouse research took over two and a half years to reach its current sophistication. The team is now exploring whether sensors on commercially available drones can serve the same purpose. ®