EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras

EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras

Speakers: Yan Long

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=5oR5GU6_xnM

Overview

The proliferation of Internet of Things (IoT) devices and other embedded systems equipped with cameras in sensitive environments, such as homes and offices, introduces significant privacy and security challenges. While software-based vulnerabilities in networked IP cameras have been a focus of extensive research, the hardware design perspective, particularly concerning physical-channel eavesdropping, has historically received less attention. This article delves into the groundbreaking research presented in "EM Eye," a comprehensive study that uncovers a critical hardware vulnerability in embedded cameras.

EM Eye demonstrates that adversaries can reconstruct high-quality image streams from the unintentional electromagnetic (EM) emissions emanating from the digital image data transmission interfaces of these cameras. What makes this discovery particularly alarming is the feasibility of such eavesdropping from distances exceeding 2 meters in many real-world scenarios, even through walls. The research covers a wide array of devices, including popular IoT camera development platforms and twelve commercial off-the-shelf (COTS) devices ranging from smartphones to dash cams and home security cameras, indicating a pervasive threat.

The implications of EM Eye are profound, suggesting that an adversary could visually spy on private activities within an enclosed room without needing direct access to the camera's network or software. The talk provides a detailed root cause analysis for this vulnerability, a robust modeling framework for understanding the leakage, and practical mitigation strategies. Furthermore, it draws parallels with known computer display eavesdropping attacks, highlighting a crucial, often overlooked, attack surface that demands immediate attention to safeguard the data confidentiality of modern sensing systems.

Background

▶ Watch: Introduction to EM Eye and its core findings (0:00)

The foundation of EM Eye builds upon prior research into electromagnetic leakage from embedded cameras. Earlier studies, such as those by Yilmaz et al., Schwarz et al., and Liu et al., successfully demonstrated the detection of a camera's mere presence or operational status (on/off) through its EM emissions. However, these works were limited to extracting a single bit of information, primarily focusing on presence detection rather than content extraction. EM Eye significantly advances this field by investigating the extent of actual camera data leakage and demonstrating the reconstruction of pixel-level information from these emissions.

Conversely, the talk also acknowledges prior work on EM injection attacks. Jiang et al. showed the feasibility of injecting EM interference to partially control CMOS camera outputs with row-level granularity, while Köhler et al. demonstrated pixel-level injection for CCD cameras. These findings collectively suggest that substantial entropy is embedded within camera EM characteristics, which EM Eye aims to harvest passively.

To understand the attack, it's crucial to grasp the architecture of embedded camera systems. A typical system comprises three main components: a Camera Sensor, an Image Data Interface, and an Embedded System Controller. The camera sensor converts photons into electrical signals, which are then digitized by Analog-to-Digital Converters (ADCs). The raw, unprocessed data from these sensors, where each pixel captures only one color due to a color filter array, is known as RAW images. An Image Signal Processor (ISP), part of the embedded system controller, then performs debayering or demosaicing to interpolate missing RGB channels, producing a full-color image.

The critical component exploited by EM Eye is the Pixel Data Transmission interface, which connects the image sensor to the downstream processing components like the ISP, GPU, CPU, and OS. Common interfaces include HiSPi, DVP, LVDS, and the widely adopted MIPI Camera Serial Interface 2 (MIPI CSI-2). MIPI CSI-2 is particularly relevant as it transmits video data frame by frame, row by row, and column by column. Physically, MIPI CSI-2 utilizes high-speed differential signaling with multiple data lanes and a shared clock lane, making it a significant source of unintentional EM emissions due to the rapid electrical signal changes. These rapid transitions, especially when transmitting digital bits, generate alternating currents and voltages that radiate EM waves, forming the basis of the EM Eye attack.

Key Findings

▶ Watch: Threat model and initial feasibility demonstration (4:00)

EM Eye's core discovery is a significant vulnerability in the digital image data transmission interface of embedded cameras, allowing adversaries to reconstruct high-quality image streams from their unintentional electromagnetic (EM) emissions. This research represents the first comprehensive attempt to analyze this specific attack surface, moving beyond single-bit leakage detection to full pixel-level image reconstruction.

The primary source of this EM leakage was identified as the unshielded image data transmission cable connecting the image sensor to downstream processing components (e.g., ISP). Through meticulous near-field EM probe measurements, researchers found significantly higher signal-to-noise ratios (SNRs) near these cables compared to other components, confirming them as the main unintentional radiating antenna.

The research established the feasibility of real-time image reconstruction from these EM signals, demonstrating that the shape of the EM signal directly correlates with the pixel values of the camera image. This capability extends to reconstructing images that share very similar structures to the camera's ground truth.

Crucially, EM Eye proved effective against a wide range of devices. Evaluations on four popular IoT camera development platforms and twelve commercial off-the-shelf (COTS) devices, including smartphones (e.g., Samsung S6), smart home cameras (e.g., Xiaomi Dafang), and dash cams (e.g., 360 M320), all confirmed their vulnerability. The attack can be executed from distances exceeding 2 meters in many cases, with some scenarios achieving up to 5 meters, even through physical obstructions like walls, doors, and windows, making it a potent threat for physical-isolation eavesdropping.

The research also provided a detailed root cause analysis and a robust modeling framework to explain the leakage process. This framework enables system defenders to identify and simulate mitigations, including improvements to embedded cameras' data transmission protocols, with minimal cost. EM Eye highlights that this vulnerability shares the same underlying physical principles as computer display eavesdropping attacks, suggesting a broader, generalized threat to data confidentiality in modern sensing systems.

Technical Deep Dive

▶ Watch: Identifying image data transmission cable as leakage source (4:50)

The EM Eye attack leverages the unintentional electromagnetic emissions generated during the digital transmission of image data within embedded camera systems. The process involves a sophisticated understanding of the underlying physics, signal processing, and machine learning techniques to reconstruct intelligible images.

Threat Model

The threat model for EM Eye focuses on passive eavesdropping on confidential camera data. The adversary exploits the unintentional EM emissions from the camera sensor, image data transmission interfaces, and image signal processors. The primary goal is to reconstruct an image stream that closely approximates the authentic camera output. The adversary is assumed to use readily available commercial hardware: an antenna to capture EM signals, a low-noise amplifier (LNA) to boost the weak signals, a software-defined radio (SDR) device (e.g., USRP 10) for digitization, and a laptop running image reconstruction algorithms.

Two main eavesdropping scenarios are considered:

1. Hidden-Antenna (HA) Scenario: The adversary installs a low-profile antenna very close to the target camera, often concealed, to receive stronger EM emissions. This could involve modifying power banks or other inconspicuous objects.
2. Physical-Isolation (PI) Scenario: The camera is situated in a physically isolated space (e.g., a private room), and the antenna is placed outside, receiving EM emissions through walls, doors, or windows. In both scenarios, the camera scenes are presumed to contain private and sensitive information.

Feasibility and Leakage Source Identification

Initial feasibility studies utilized a Raspberry Pi camera V1 (RPi V1) to record simplified black and white scenes displayed on a computer monitor. Using a near-field EM probe, researchers observed periodic signals at 30 Hz, matching the camera's frame rate, at various center frequencies, including multiples of 51 MHz (e.g., 204 MHz). Zooming into these signals revealed distinct transmissions for different rows, interspersed with blanking periods. Crucially, a clear correlation was found between the shape of the EM signals and the pixel values of the camera image.

To pinpoint the exact source of EM leakage, a tiny near-field magnetic probe was used to collect emissions from individual components while shielding others. This revealed significantly better signal-to-noise ratios (SNRs) when the probe was positioned near the image data transmission cable connecting the image sensor and downstream processing components. This led to the definitive conclusion that this cable is the primary EM leakage source.

For basic image reconstruction, the adversary needs to map the one-dimensional EM signals, received within a specific frequency band, back to a two-dimensional image matrix. This involves estimating key parameters such as pixel and row transmission rates, image dimensions, and blanking periods. The amplitudes of the EM signals are then converted to gray-scale pixel values, essentially performing amplitude demodulation. This basic reconstruction process, denoted as R_base, can reconstruct images sharing very similar structures to the camera's ground truth in real-time.

Digital Image Transmission Leakage Model and Distortions

To refine R_base and understand the underlying physics, a fundamental information leakage model was developed, involving two stages:

1. Digital Bit Transmission: The camera sensor converts optical signals into digital bits, which are transmitted row by row. Rapid bit flips (changes from 0 to 1 or 1 to 0) generate alternating currents/voltages. According to Maxwell's equations, these electrical changes produce EM waves.
2. EM Wave Propagation: The transmission cable, acting as an unintentional antenna, propagates these EM waves to the adversary's receiving antenna. These signals are inevitably subjected to environmental noise.

Using MIPI CSI-2 with RAW10 image data and two data lanes as an example, RAW10 represents each pixel/column with 10 ordered bits (B0 to B9, LSB to MSB, LSB transmitted first). Four consecutive pixels are packed into five bytes. The Dual Data Rate (DDR) technique means the clock frequency (f_clk) is twice the bit transmission frequency (f_t). For RPi V1, f_clk is 204 MHz, leading to a byte transmission frequency of 51 MHz. Consecutive bytes are distributed sequentially across data lanes. Each wire (data and clock) generates its own EM signals, which mix at the receiver.

A mathematical model was developed to simulate this process, expressing the EM reconstruction image, I_EM, as R_basez + b_clk + F_filtl, h, F_data(I_GT), where 'z' is noise, 'b_clk' is a constant offset from clock wire emissions, 'F_filt' is the EM energy transfer function, and 'F_data' is the digital data transmission function mapping a 2D image to a 1D bit stream. Even with simplified approximations, simulated images closely matched actual EM reconstructions.

Several key characteristics and distortions were identified in the eavesdropped images:

• Baseband Leakage Frequency Dependency: EM emissions are wideband baseband signals. Different frequency bands contain different information; for instance, 204 MHz might better capture edges, while 255 MHz might better capture gray-scale details. Frequencies near the fundamental and harmonic of the byte transmission frequency (51 MHz) exhibit the strongest signals and best quality.
• Multi-wire Signal Polarity Inversion: Interference between EM signals from data and clock wires can cause the EM signal amplitude to invert at certain frequency bands, leading to inverted gray-scale polarity in the reconstructed image.
• Practical Sampling Distortion: These cause structured distortion patterns:
• Loss of color information: Only gray-scale information remains, as EM emissions primarily reflect overall bit activity.
• Shuffled gray-scale mapping: Original and reconstructed images have different but correlated gray scales. Bright, saturated pixels in the original image often map to dark polygons in EM reconstructions because they cause fewer bit flips (less change in bit values) and thus lower EM amplitudes.
• Light gradient & high-frequency noise: Ellipse/contour-like shapes and high-frequency noise appear due to imperfect sampling and the loss of bit-ordering information. The adversary effectively sums up bit emissions (U_EM = Σ B_i) without their individual weights, amplifying light intensity variations and high-frequency noise.

Eavesdropping System Design

To address these challenges and improve reconstruction quality, a comprehensive signal processing pipeline was designed, as shown in Figure 7:

1. Single-band Image Reconstruction: This is the core process, R_base, for each frame. The formula I_EMi_f, i_r, i_c = (1 / N_samp) Σ an (where n ranges from n1 to n2, i_f, i_r, i_c are frame, row, and column indexes, T_f, T_r, T_c are transmission durations, mn is discrete IQ measurements, and F_amd is amplitude demodulation) is used. The actual column resolution, W_EM, is determined by f_s T_fd / H_EM.

• Frame averaging is performed on consecutive frames to mitigate random noise.
• A polarity-correction step compares single-band reconstructions with data wire-only simulations, inverting polarity if detected.
• Histogram equalization is applied to reduce the impact of clock signal offset on image contrast.

1. Distortion-guided Multi-band Combination: Images reconstructed from different frequency bands are combined. The criterion is to minimize light gradient distortions on single-color surfaces, which arise from lost bit-ordering information. Different frequency bands embed different inter-bit information. The empirical formula for combination is I_EM = Σ w_i * I_EMl_i, h_i where N is the number of available bands (typically 1-3), w_i is the weight for band i, S is a segmentation function to select a single-color subarea, and c is a constant representing its gray scale. Thresholding is also used to remove noisy components.

1. Image-to-image Translation: To further mitigate distortions and enhance visual quality, a supervised image-to-image translation process is employed. This is inspired by the observation that distortions like light gradients and dark polygons in EM reconstructions have structured mappings to original image features. The problem is formulated as an image-to-image translation from the EM-reconstructed image space to the original camera output space. The research adopts pix2pix 17, a conditional Generative Adversarial Network (GAN), to reconstruct a higher-quality image I_EM from Î_EM. This process effectively removes most remaining distortions, even approximating colors, though the fundamental analysis focuses on gray-scale.

This detailed pipeline allows EM Eye to overcome the inherent complexities and distortions of EM side-channel signals, translating raw emissions into visually coherent and interpretable images.

Demo / Proof of Concept

▶ Watch: Process of basic image reconstruction (R_base) (5:20)

The evaluation of EM Eye was extensive, designed to quantify the attack's limits under various camera designs and environmental conditions, demonstrating its real-world applicability and effectiveness.

Experimental Setup and Metrics

For reproducibility and scalability, a consistent setup was used where images from different scenes were displayed on a monitor and recorded by the cameras under test. Two existing datasets were utilized:

1. Face Detection Data Set and Benchmark 18: A subset of 3,000 randomly selected images, each containing at least one person.
2. MIT Indoor Scenes Benchmark 31: A subset of 3,000 randomly selected images.

For training the supervised image-to-image translation network (pix2pix), 2,700 corresponding Î_EM images from each dataset were used. Evaluation was performed over all 600 test images, with a fine-grained factor analysis using a subset of 35 images per dataset. All experiments used an EM sampling rate (f_s) of 8 MHz.

Four quantitative metrics were employed to assess the impact of different factors on both EM signal and image perception levels:

1. Unintentional Signal-to-Noise Ratio (USNR) 8: Measures the ratio of unintentional EM emission power to background noise power.
2. Structural Similarity Index Measure (SSIM): Quantifies the similarity between the eavesdropped and ground-truth camera images.
3. Face Detection Rate (Fdetect): Calculates the ratio of faces detected in the eavesdropped images (I_EM) to those in the ground-truth images (I_GT), using MATLAB's Cascade Object Detector 26.
4. Indoor Scene Captioning Rate (Icaption): Calculates the ratio of the longest common subsequence between descriptive caption texts generated from I_EM and I_GT, using MATLAB's rougeEvaluationScore function 27 and an NLP Connect image captioning model 29. All metrics range from 0 to 1, with higher values indicating better quality.

Evaluation Results

Sensor and Controller Factors: Evaluation across various camera sensors and controllers (Table I) revealed that sensors have a larger impact on EM reconstructions than controllers, as sensors dictate image data format and transmission speed. The EM Eye pipeline successfully reconstructs images across diverse sensor/controller settings. Dedicated models (TrainB) trained for specific sensor-controller combinations significantly improved image quality compared to a generalized base model (TrainA). TrainA showed improvements over state-of-the-art (SOTA) results of 166.5% in SSIM, 72.2% in Fdetect, and 52.2% in Icaption. TrainB further boosted these to 256.2% in SSIM, 143.7% in Fdetect, and 88.7% in Icaption, demonstrating the power of tailored machine learning.

Transmission Cable & Environmental Factors:

• Cable EM Shielding: Tests on 15 cm cables showed that conductive fabric and aluminum foil shielding reduced USNR by 9.84 dB and 14.33 dB, respectively. Despite this, acceptable image reconstructions were still possible, highlighting the persistent vulnerability.
• Antenna-camera Distance and Cable Length: EM emission strength attenuates with distance. Longer cables generally yielded higher metric values at the same distance, likely due to a larger effective radiating area. Maximum eavesdropping distances achieved were 50 cm (3cm cable), 200 cm (10cm cable), 270 cm (15cm cable), 400 cm (30cm cable), and 450 cm (50cm cable).
• Antenna-camera Angle: At close distances (3 cm), the angle had minimal impact. However, at larger distances (40 cm), angles between 90 and 270 degrees significantly lowered SSIM, Fdetect, and Icaption values.
• Interference: Modern displays (TVs, monitors, smartphones) can interfere, but their higher refresh rates (60, 120, 240 fps) compared to embedded cameras (30 fps) allow for distinction. Non-overlapping frequency bands can also be selected. Background noise can be filtered out using analog filters, significantly improving reconstructed image quality.

COTS Devices & Case Studies

EM Eye was evaluated on 12 commercial-off-the-shelf (COTS) camera devices: 4 smartphones, 6 smart home cameras, and 2 dash cams, all tested in their original packaging.

• All devices were vulnerable in hidden-antenna (HA) scenarios.
• Crucially, 8 out of 12 devices allowed physical-isolation (PI) eavesdropping through windows, doors, and walls.
• Maximum eavesdropping distances varied from 1 cm to 500 cm, largely due to cable length and shielding materials (smartphones often use shorter, better-shielded cables; dash cams and home security cameras tend to use cheaper, unshielded, longer cables).

Three typical case studies were demonstrated:

1. Smartphone Camera Eavesdropping: In an HA scenario, an adversary could integrate an antenna and EM receiver into a modified power bank. Eavesdropping on a Samsung S6 phone demonstrated the reconstruction of sensitive documents like a QR code, social security card, and a driver's license. The maximum distance for smartphones was around 30 cm.
2. In-car Peeking: With dash cams, an adversary could peek inside parked cars. An example with a 360 M320 dashcam showed an antenna 50 cm from the car (100 cm antenna-camera distance) capturing EM emissions. Reconstructed images revealed a person using their phone in the driver's seat and another in the back seat. This scenario was feasible from up to 5 meters.
3. Through-wall Room Spying: For IoT home security cameras, an adversary could spy on a private household or office room. Eavesdropping on a Xiaomi Dafang home camera with an antenna 70 cm outside the room (150 cm antenna-camera distance) reconstructed images of a person sleeping on a couch and a confidential document on a desk. This was also feasible from up to 5 meters.

These demonstrations unequivocally prove the significant and widespread threat posed by EM Eye across common embedded camera devices in real-world scenarios.

Defensive Implications

▶ Watch: Detailed model of digital image transmission leakage (6:00)

The EM Eye research not only identifies a critical vulnerability but also proposes and evaluates several countermeasures from the perspective of camera and system designers.

• EM Jamming: While a theoretical possibility, jamming is deemed less suitable for mitigating EM Eye. The wideband nature of the leaked signals would necessitate expensive jamming devices, and there's a significant risk of compromising legitimate camera data or other electronic systems, as shown in previous EM injection research.

• Shorter Cables & Better Shielding: This is identified as a highly effective countermeasure. Evaluations demonstrated that shorter, better-shielded cables significantly reduce EM emissions, achieving over 10 dB reduction in USNR. However, implementing this might require a complete mechanical redesign of existing devices, which can be costly and impact form factors. Despite the reduction, some level of reconstruction was still possible, indicating that shielding alone might not be a complete solution.

• Increase and Randomize Transmission Blanking: Current MIPI CSI-2 protocols include blanking periods between frames and rows. Increasing the duration of these blanking periods would reduce the effective resolution available to eavesdroppers. Furthermore, randomizing the duration of these blanking periods would make it significantly harder for adversaries to perform frame averaging, a crucial step in the EM Eye pipeline for mitigating random noise and improving signal quality. This approach would necessitate higher bit rates from the transmission interface to maintain the same effective frame rate.

• Grouped Pixel Smoothing Protocol Improvement: The research argues that current image data transmission protocols are fundamentally flawed in their EM characteristics. A novel approach proposes rearranging bits to group similar bits from adjacent pixels into a byte. This "grouped pixel smoothing" technique aims to reduce the frequency of bit transitions (0-to-1 or 1-to-0 changes) within the data stream. Fewer bit transitions translate directly to lower amplitude alternating currents/voltages and, consequently, reduced EM emission amplitudes. Simulations (Figure 14) show that this can mitigate strong emission peaks by over 10 dB. This approach is particularly attractive as it requires minimal modifications to existing protocols, especially for 8-pixel grouping, offering a cost-effective and impactful mitigation.

• Other Sensing Devices: The methodology and findings of EM Eye are not limited to cameras. The threat of EM side-channel eavesdropping can be extended to other sensing devices that transmit unencoded plain data. Given that many such sensors often have lower data throughput compared to cameras, they might be vulnerable to attacks with even less sophisticated equipment. The principle of EM leakage from deterministic digital data transmission is broadly applicable. For devices transmitting encoded video (e.g., H.264), direct image reconstruction is challenging, but machine learning classifiers can still recognize image patterns from EM signals, achieving 90.12% accuracy for 100-class classification with a Logitech C920x webcam, indicating a persistent, albeit different, threat.

Key Takeaways

• Widespread Hardware Vulnerability: Embedded cameras in IoT devices, smartphones, dash cams, and home security systems are widely vulnerable to electromagnetic side-channel eavesdropping, allowing high-quality image reconstruction from unintentional EM emissions.
• Primary Leakage Source: The main source of this vulnerability is the unshielded digital image data transmission cable connecting the image sensor to the processing unit, which acts as an unintentional radiating antenna.
• Significant Eavesdropping Distances: The attack is feasible from distances over 2 meters, with some COTS devices allowing eavesdropping up to 5 meters, even through walls and other physical obstructions.
• Advanced Reconstruction Pipeline: Reconstructing intelligible images requires a sophisticated multi-stage signal processing pipeline, including frame averaging, polarity correction, multi-band combination, and supervised image-to-image translation using GANs like pix2pix.
• Effective Mitigation Strategies: Countermeasures such as using shorter, better-shielded cables and, more importantly, implementing a novel "grouped pixel smoothing" data transmission protocol can significantly reduce EM leakage (over 10 dB) with minimal redesign effort.
• Broader Implications for Sensing Systems: The underlying physical principles of EM Eye are analogous to computer display eavesdropping attacks and extend to other sensing devices that transmit unencoded digital data, highlighting a generalized security concern for modern sensing systems.

About the Speaker(s)

Yan Long is the speaker who presented the research on EM Eye. Based on the technical depth and comprehensive nature of the work, Yan Long is a researcher with expertise in embedded systems security, hardware vulnerabilities, and electromagnetic side-channel analysis. The presentation demonstrates a strong background in signal processing, machine learning (particularly GANs), and practical evaluation of security threats against commercial devices. Yan Long's work contributes significantly to understanding and mitigating physical-layer attacks on privacy-sensitive embedded camera systems.