Researchers can make headphones leak audio through a wall, but the 30-meter claim has a few caveats

HKUST (Guangzhou) and HK PolyU researchers' InjectEave beams a radio carrier at devices so their own circuits leak analog audio The leaked audio has already been decrypted by the device itself, making encryption offer no protection against such an approach The 30m headline needed a pricey amplifier

<![CDATA[ <article> <ul><li><strong>HKUST (Guangzhou) and HK PolyU researchers' InjectEave beams a radio carrier at devices so their own circuits leak analog audio</strong></li><li><strong>The leaked audio has already been decrypted by the device itself, making encryption offer no protection against such an approach</strong></li><li><strong>The 30m headline needed a pricey amplifier pushing output to 10 W, while standard ranges of 1 to 6m were measured by detecting a test tone</strong></li></ul><p>Researchers at the Hong Kong University of Science and Technology and the Hong Kong Polytechnic University have shown that everyday headphones, a desk phone, and a handful of smart-home gadgets can broadcast what they are doing simply by using a radio signal.</p><p>The technique, called <a href="https://injecteave.github.io/" target="_blank">InjectEave</a>, was presented at USENIX Security 2026 in Baltimore, and multiple outlets <a href="https://www.theregister.com/security/2026/09/17/researchers-find-way-to-listen-in-on-headphones-from-afar/5297303" target="_blank">have since covered</a> the researcher's claim that the attack "can recover headphone audio from up to 30 meters away, including through walls".</p><p>The claim may be accurate, but it has limitations, including the need for specialized equipment that is often very noticeable in most settings.</p><h2 id="an-impressive-technical-show-with-plenty-of-limitations-in-tow">An impressive technical show with plenty of limitations in tow</h2><p>Conventional electromagnetic eavesdropping waits for a device to leak. That works poorly for audio, because speech sits below 20 kHz while a device's wiring radiates efficiently only at megahertz or gigahertz frequencies.</p><p>InjectEave chooses to close the gap by transmitting a carrier signal at the target. According to <a href="https://injecteave.github.io/assets/paper/sec26cycle2-final651.pdf" target="_blank" rel="nofollow">the paper</a>, nonlinear components such as amplifiers, analog-to-digital converters, switching MOSFETs, and power converters mix the secret signal onto that carrier, and the device's own traces and cables radiate the result back to a receiver.<br><br>Because the leak happens in the analog path, after audio has been decoded, the project page states that "InjectEave is immune to digital defenses such as encryption, masking, and randomization." Encryption in any form on a wireless headset is irrelevant, since the attack directly targets the signal driving the speaker, not the radio link.</p><p>The team demonstrating this used a USRP B210 software-defined radio, two antennas, a Siglent spectrum analyzer, and a laptop to set up their proof of concept, which could, as they noted, "eavesdrop on the majority of these devices from over 2m away and through walls, with a maximum distance of 30m for recovering intelligible headphone audio". </p><p>This isn't the first time the technique has been used, even as the researchers have built on it considerably; the idea <a href="https://en.wikipedia.org/wiki/The_Thing_(listening_device)" target="_blank">originates from "The Thing</a>," a Soviet bug given as a gift to the US ambassador in Moscow in 1945, which was passively powered remotely as a listening device.</p><p>InjectEve, however, does not involve planting anything; instead, it leverages existing work on interference-induced leakage and impedance-based backscatter, and distinguishes itself by recovering coarse digital data rather than continuous analog waveforms, allowing users to 'listen in' without added steps.</p><p>The same approach applies to wired headphones, which are also prone to leaking microphone audio; researchers concluded that their sound cards were the primary source of the leaks, which were being sent back over very short distances.</p><p>The threat is somewhat tempered by the fact that it can capture what users hear but, with wireless headphones, cannot hear what the user is saying. The attacker also has to transmit continuously and use a high-powered (10W) transmitter to reach the full 30-meter range, even though capturing and rendering speech is harder than the tones the test used to prove the approach worked.</p><p>The attacker also needs to know the target model and profile a matching unit first, although they managed to get a profile to transfer cleanly across three identical UGreen headsets, suggesting this might be easier than one would assume.</p><p>The researchers say they reported the findings to the affected manufacturers but, "as we have not yet received a response," withheld the table's frequencies and stripped injection control logic from their released code. One shouldn't be too hopeful, however, as no software update can fix an analog leak, and it is relatively limited in practical abuse cases.</p> </article> ]]>