5 ways to protect audio and microphones from malicious exploits
Connecting state and local government leaders
Hackers can find their way into the most secure environments through an often overlooked vulnerability: the computer microphone.
A secret spy exists on nearly every computer: its microphone. Through remote access trojans (RATs) these hackers are finding their way into even the most secure government and corporate environments. They can capture audio information and send it off as compressed audio files via email, an encrypted stream or pictures for unscrupulous uses. Even computer speakers can be used as microphones, so a computer can still be compromised if its audio and microphone channels are not physically separated.
As more organizations embrace Voice over Internet Protocol (VoIP) phone systems, the risk grows exponentially. Even in secure offices where information may be highly confidential, secure data is being exposed at an alarming rate.
RATs working through a hole in an organization’s firewall or unsecured local area network can run invisibly on host PC and laptops, permitting an intruder to have remote access and control. These intruders, which often rely on zero-day vulnerabilities that are not detected by security software, can remotely activate the use of microphones. Then they can capture sounds from the user and his surrounding environment.
Since many VoIP networks switch data between networks of varying security levels, the exposure risk of electromagnetic interference leakage is compounded. And because most firmware is reprogrammable, the switch logic can be tampered with, and there is no way to track whether it has been opened or compromised. Additionally, the use of memory buffers and other types of data storage can further increase the risk of exploitation. These technologies can even be manipulated by malicious software as users switch between computers.
But a new breed of technology is emerging to prevent malicious audio signal interception. The approach is designed to enable centralized control over audio ports while reducing the possibility of analog “cross-talk” caused by audio signals between computers running at different security levels. Ideally, secure audio and microphone security solutions should support both stereo audio and microphone analog signals and allow users to securely share headsets, speakers and microphones between computers or IP phones without the risk of breach.
By keeping audio signals physically separated from the microphone or speaker signals, secure audio and microphone technologies can eliminate the possibility of leakage between signals on either side. As a result, organizations can prevent signals from being exploited or manipulated by malicious software, thereby maintaining the integrity of the signal when users switch between computers.
Further, the use of a hardware microphone mute button, which can physically shut off a microphone when not in use, can extend system security. Mute buttons cannot be manipulated by software or drivers, thereby assuring even more security.
When selecting options for audio and microphone security to cut the risk of audio signal interception, consider using these practices:
- Select solutions with non-reprogrammable firmware, which prevents the ability to tamper with the switch logic.
- Place a metal-plate firewall between the audio and microphone printed circuit boards to reduce the potential of electromagnetic interference leakage.
- Ensure that tamper-evident tape has not been breached – holographic security labels placed on the enclosure provides a visual indication if the switch has been opened or compromised.
- Reduce user errors with port coloring. Color chips – which can be inserted into each port-selector button – facilitate easy port identification and reduces user error.
- Use secure packaging. Look for “tear away” packaging that ensures the secure delivery of the switch as it is routed to the end user.
It’s estimated that the U.S. government is attacked hundreds of thousands of times every day, making security threats impossible to eliminate altogether. Yet, by following practices to secure audio and microphone usage (especially in government and highly regulated industries including finance and healthcare), users can continue to benefit from the simplicity and low cost of VoIP systems, without the risk.