“We think we’ve created the first laser microphone that’s actually modulated in the radio frequency range,” Kamkar says. “Once you’ve got a radio signal, you can treat it like a radio and take advantage of all the tools that exist for wireless communication.” In other words, Kamkar converted sound to light, then light to radio, and back again.
Sammy Kamkar at his workstation at home.Photo: Roger Kisby
For his keystroke detection technique, Kamkar fed the laser microphone’s output into an audio program called iZotopeRX to further remove noise, and then into open source software called Keytap3 to convert the sounds of keystrokes into readable text. Indeed, security researchers have demonstrated for years that they can decipher what a surveillant’s target is typing by analyzing audio of keystrokes recorded with a nearby microphone and distinguishing subtle acoustic differences between various keys. One group of researchers has even shown that they can derive relatively accurate text from the sounds of keystrokes recorded during a Zoom call.
But Kamkar was more interested in a 2009 Defcon demo, in which security researchers Andrea Barisani and Daniele Bianco showed how a simple laser microphone could be used to roughly detect words typed on a keyboard — a trick that could enable line-of-sight spying from long distances. In that demo, the two Italian hackers tested their laser spying tech from a laptop on the other side of the room, and only got as far as generating a list of possible word combinations that matched the vibration signatures they’d recorded.
Balisani told WIRED that their experiment was a “quick” proof of concept compared to Kamkar’s more sophisticated prototype. “Sammy was smart and had a lot of room to improve,” Balisani said. “I’m 100% confident that he could have improved our attack, both in the hardware setup and in the signal processing.”
Kamkar’s Laser Spy Kit: Infrared Laser…Photo: Roger Kisby
…connect to the oscilloscope signal generator, current controller, temperature controller, and amplifier power supply.Photo: Roger Kisby
Kamkar’s results certainly seem dramatically better. He recovered a sample of text typed using the laser microphone and shared it with WIRED, finding it almost perfectly legible, with only a single character missing every word or two. For other samples, the results were a bit more uneven. Because Kamkar’s laser microphone worked well enough to detect keystrokes, he also tested it by bouncing an infrared laser off a window to record more typical indoor audio. The result was a surprisingly clear sound, at least noticeably better than other laser microphone audio samples secretly recorded from window vibrations.
Of course, laser microphones have been around for decades, so Kamkar acknowledges that he doesn’t know how far the technology has come in commercial implementations available to governments and law enforcement agencies. And he’s not aware of any even more covert, custom-made technology that may be created or used by intelligence agencies. “I would imagine they’re doing this or something similar,” Kamkar says.
But unlike professional spy tool builders, Kamkar has published full schematics for his laser-mic spy kit. “Ideally, the public would know everything intelligence agencies are doing and what they’re going to do next,” Kamkar says. “If you don’t know something can happen, you can’t probably prevent it.”
