How Hackers Can Use Electromagnetic Waves to Eavesdrop on Your Devices from Across the Room

This week in the Garden Dispatch, we examine: How Hackers Can Use Electromagnetic Waves to Eavesdrop on Your Devices from Across the Room.

Let's dive in.

November 2026 — Hardware Security & RF Physical Side-Channel Research

Imagine a physical security attack that takes faint, unnoticeable emissions from your electronic devices and forcefully turns them into loud, long-range broadcasts. That is precisely what researchers uncovered in breakthrough hardware security research presented at USENIX Security: Injection-Induced Electromagnetic Side Channels (InjectEave).

The Problem: Why Old-School Hardware Attacks Hit a Wall

For decades, hardware security experts divided physical attacks into two distinct playbooks:

• ◆Passive Side-Channel Analysis (SCA): Quietly listening to tiny physical leaks—like micro-fluctuations in power consumption or electromagnetic (EM) radiation—to steal secret data without disturbing the system.
• ◆Active Fault Injection (FIA): Blasting the chip with clock glitches, voltage spikes, or laser pulses to force errors and break software logic.

Passive EM eavesdropping comes with a fundamental physical limitation: signal-to-noise ratio (SNR) degradation. Faint electromagnetic whispers from internal chips rapidly fade over distance, get drowned out by ambient radio noise, and are heavily muffled by protective components and ground planes on modern circuit boards.

InjectEave turns this dynamic completely on its head. Instead of just listening passively, attackers inject a high-power EM carrier signal to actively upconvert and amplify those hidden whispers, beaming them right out of the targeted device.

1. How It Works: Turning Silicon Components into Radio Transmitters

Rather than causing bit-flips or system crashes, InjectEave targets the non-linear physical behavior inherent in everyday analog components like amplifiers, converters, and power chips.

Attacker: Injects High-Power Carrier Signal (f_carrier)
                       |
                       v
       +-----------------------------------------------+
       | Target Device Under Attack                    |
       |                                               |
       |   Secret Signal (e.g., audio, sensor data)    |
       |             |                                 |
       |             v                                 |
       |      [ Non-Linear Hardware Component ]        |
       |      (Op-Amps, ADCs, DACs, Power Regulators)  |
       +-----------------------------------------------+
                       |
                       v
         Signals Mix & Modulate:
             f_out = f_carrier ± f_secret
                       |
                       v
Attacker: Picks up clear high-frequency radio signal at long distance (30m+)

The attack breaks down into four interconnected physical stages:

• ◆Non-Linear Intermodulation: Standard electronic parts—like operational amplifiers, voltage regulators, and analog-to-digital converters—do not respond strictly linearly (y(t) = a₁ x(t) + a₂ x²(t) + a₃ x³(t) + \dots). They naturally mix electrical signals passing through them.
• ◆Carrier Modulation: When an attacker aims a focused, high-frequency electromagnetic carrier wave (f_carrier) at target circuit traces, internal semiconductor junctions mix that wave with active internal electrical signals.
• ◆Frequency Upconversion: The target device's low-frequency secret data (s(t) at f_secret) piggybacks on the high-frequency carrier signal, generating strong new intermodulation sidebands (f_carrier ± f_secret).
• ◆Controlled RF Broadcasting: By picking frequencies where circuit board traces act like resonant antennas, the attacker essentially tricks the target device into broadcasting its own private internal operations across long distances.

2. Real-World Attack Scenarios

This physical vulnerability is not just theoretical—researchers demonstrated it across several real-world targets:

A. Long-Range Audio Eavesdropping (InjectEave)

• ◆Attack Goal: Eavesdropping on shielded audio cables, phone calls, or wireless headphones.
• ◆The Challenge: Audio signals operate at low frequencies (20 Hz to 20 kHz), emitting virtually zero receivable passive EM signals beyond a couple of inches.
• ◆The Injection Trick: Aiming a continuous radio wave at the audio amplifier stage causes the internal circuits to blend the private audio onto the reflected radio wave.
• ◆The Result: Researchers picked up clear, recognizable speech through solid walls at distances exceeding 30 meters using standard, off-the-shelf software-defined radios (SDRs) and directional antennas.

B. Active Side-Channel Profiling of Crypto and Sensors

The technique works equally well against microcontrollers and system-on-chip (SoC) processors:

• ◆Extracting Cryptographic & Power Data: A chip's power usage ripples depending on the exact calculations it performs. By targeting voltage regulators with EM waves, attackers can upconvert those tiny power ripples into easily receivable high-frequency radio signals.
• ◆Punching Through Physical Shielding: Because the attacker supplies the signal's energy, the upconverted broadcasts can easily punch through lightweight metal enclosures and Faraday shields that normally stop passive leaks.

Comparing Attack Methods: Passive vs. Active vs. InjectEave

Here is a side-by-side comparison illustrating why injection-induced leakage redefines hardware threat models:

How Engineers Can Protect Hardware

Defending against injection-induced side channels requires hardware-level safeguards rather than relying solely on software-level encryption:

• ◆RF Clamping and Low-Pass Filters: Adding components like ferrite beads and TVS diodes directly to circuit traces suppresses incoming high-frequency signals before they hit vulnerable analog components.
• ◆Differential Signal Topologies: Using fully balanced differential signal paths ensures external RF energy hits both signal lines equally as a common-mode signal, allowing circuits to naturally reject the noise.
• ◆On-Chip Active Anomaly Detectors: Integrating dedicated RF power detectors near sensitive modules can alert the system to shut down or clear secret data if unexpected RF energy is detected.

What Does This Mean for the Hardware & Security Community?

For security engineers and embedded hardware designers, InjectEave closes the false sense of comfort provided by Faraday cages and passive distance barriers. When physical attackers can supply the broadcast energy from across the room, the perimeter is no longer at the chassis—it is at the circuit trace itself. Defending tomorrow's silicon demands designing analog resilience directly into the board layout from day zero.