Technical TSCM Blog: Mic and Wire Attacks
Mic and wire attacks are the oldest attacks in the book.
Mic and wire (audio) threats are the most neglected area of many sweep teams, in spite of the fact that the wired mic is the first choice of professional attack teams. The professional attacker likes to use very sensitive and small amplified microphones which will pick up room conversations from up to forty feet. Microphones are abundant, cheap, easy to install and highly effective when properly installed. Moreover, they are persistent, last a long time and very difficult to detect.
Contact/Spike Microphone
Of the microphones available, the contact and spike variety are specifically designed for the purpose of eavesdropping. These ‘electric’ microphones contain a tiny crystal which, when vibrated by audio waves, produces a very small electrical signal.
Office Speakers
Attackers frequently use speakers found in intercom or office music systems since most speakers are similar to a magnetic microphones with coils. When used as a speaker, current is passed through the coil which vibrates the speaker to provide sound. Most speakers show degrees of reciprocal operation and can be used by the attacker as a microphone. When room audio waves reach the speaker, they vibrate the coil of wire in the speaker’s magnetic field and small amounts of electrical energy are produced which can be transmitted over wires to a listening post.
Wiring for Audio Transmission
The attacker will normally connect the microphone to an amplifier or tape recorder and use whatever spare wiring is available. Fortunately, for the attacker, there are lots of spare cables and wires left over from previously removed computer systems, analogue telephone systems and data networks. In one attack installation uncovered by an associate in Europe last year, a clever attacker compromised the unused pairs of an existing CAT 5 cable and a VOiP phone to exfiltrate audio out of a highly sensitive conference room. In another scenario, the attackers ‘painted’ using copper paint, a set of lines that they used to convey audio out of a newly-refurbished conference room. They then covered up the painted lines with the room-colour paint, and no one was the wiser that an audio exfiltration path had been created.
Detecting Mic and Wire Attacks – Efficiently
Traditionally, the TSCM professional used a variety of tools, including a portable oscilloscope, precision multi-meter, and specialized multi-function cable meters, time-domain reflectometers and clip-on audio amplifiers to test each line in the facility for the presence of audio, a mic or a line tap – a time consuming and complex approach to finding room audio. The traditional complicated equipment training is in excess of one week!
The Shearwater Digital Bloodhound, designed using electro-magnetic principals, incorporates an ASMD - Acoustically Stimulated Microphone Detector for detecting audio eavesdropping. This revolutionary and highly specialized tool, developed by the designers while in Government service, and updated with highly selective DSP technology last year, is fully portable and easy to learn. We can teach a typical student to use the Bloodhound and become an effective ‘mic and wire sweeper’ in less than a day!
Bloodhound operates by detecting the very tiny electromagnetic spatial field created when an audio signal from a microphone is generated. Bloodhound uses a special and proprietary field probe unit with high amplification and incorporates elaborate digital filtering algorithms and high speed DSP technology to remove extraneous power line noise frequencies so that only the audio on the compromised line is detected.
The Bloodhound has two modes: Active and Passive.
In the more covert Passive mode, when one doesn’t want to alert the attacker’s ‘listening post’ the operator simply tests all areas of the room under investigation for the presence of audio. Generally, we find that the sensitive Bloodhound digital probe only needs to be within a foot or so of the mic, or its associated conducting cable, in order to pick up room audio. Of course, the Bloodhound’s comprehensive kit of components provides the tools to generate common everyday sounds, typical of any environment, so the attacker won’t know you are there. With Bloodhound there is no more time-consuming and often dangerous probing of telephone wires, CAT 5 cables, power lines.
In the Active mode, the operator can use the advanced digital probe and associated high gain audio amplifier to induce acoustic feedback to easily detect microphones. The characteristic acoustic howl cannot be mistaken!
With a combined usage of the Active and Passive mode, Digital Bloodhound detects:
- Amplified wired microphone attack system where the target site is wired directly to a listening post.
- Audio attack on telephone instruments.
- Audio presence on cables of all types and varieties.
- Radio Microphones – audio component.
- Tape recorder attacks (many types).
- Video camera surveillance (many types).
- Carrier current microphones.
The procedure for using the Bloodhound is quite simple, requires minimal training and significantly reduces the amount of complicated effort previously involved for detecting mic and wire attacks.
"Specialized Intelligence and Privacy Protection"
© 2012 - Waypoint Counter Surveillance | 
