Modern vehicles are widely equipped with in-vehicle audio systems, and drivers routinely play music, podcasts, navigation prompts, phone calls, and various voice services during daily commutes. Due to the enclosed nature of the vehicle cabin and the presence of substantial ambient noise, in-vehicle content is commonly assumed to be inherently private and imperceptible from outside the vehicle. In this work, we show that this assumption does not always hold and reveal a previously unexplored leakage channel for in-vehicle audio. We propose Vehisper, the first systematic study investigating the feasibility of passively eavesdropping on in-vehicle audio from outside a moving vehicle. We discover that, during operation, in-vehicle loudspeakers excite the vehicle's metallic structure, giving rise to observable low-frequency magnetic leakage outside the vehicle, which forms a stealthy side channel that has not been explored in prior work. Building on this insight, we design a compact external sensing device and develop a multi-stage signal processing pipeline to systematically cope with the strong and complex magnetic interference introduced by vehicle motion, as well as spectral distortion and perceptual degradation induced by the leakage channel. We conduct a comprehensive evaluation of Vehisper on 20 commercial vehicles from 10 major manufacturers. Experimental results demonstrate that, under real driving conditions, Vehisper can reliably recover in-vehicle audio, achieving an average word error rate of 7.85%.

Sound eavesdropping using light has been an area of considerable interest and concern, as it can be achieved over long distances. However, previous work has often lacked stealth (e.g., active emission of laser beams) or been limited in the range of realistic applications (e.g., using direct light from a device’s indicator LED or a hanging light bulb). In this paper, we presentEchoLight, a non-intrusive, passive and long-range sound eavesdropping method that utilizes the extensive reflection of ambient light from vibrating objects to reconstruct sound. We analyze the relationship between reflection light signals and sound signals, particularly in situations where the frequency response of reflective objects and the efficiency of diffuse reflection are suboptimal. Based on this analysis, we have introduced an algorithm based on cGAN to address the issues of nonlinear distortion and spectral absence in the frequency domain of sound. We extensively evaluateEchoLight’s performance in a variety of real-world scenarios. It demonstrates the ability to accurately reconstruct audio from a variety of source distances, attack distances, sound levels, light sources, and reflective materials. Our results reveal that the reconstructed audio exhibits a high degree of similarity to the original audio over 40 meters of attack distance.

Sound eavesdropping using light has been an area of considerable interest and concern, as it can be achieved over long distances. However, previous work has often lacked stealth (e.g., active emission of laser beams) or been limited in the range of realistic applications (e.g., using direct light from a device’s indicator LED or a hanging light bulb). In this paper, we present EchoLight, a non-intrusive, passive and long-range sound eavesdropping method that utilizes the extensive reflection of ambient light from vibrating objects to reconstruct sound. We analyze the relationship between reflection light signals and sound signals, particularly in situations where the frequency response of reflective objects and the efficiency of diffuse reflection are suboptimal. Based on this analysis, we have introduced an algorithm based on cGAN to address the issues of nonlinear distortion and spectral absence in the frequency domain of sound. We extensively evaluate EchoLight’s performance in a variety of real-world scenarios. It demonstrates the ability to accurately reconstruct audio from a variety of source distances, attack distances, sound levels, light intensity, light sources, and reflective materials. Our results reveal that the reconstructed audio exhibits a high degree of similarity to the original audio over 40 meters of attack distance.