Our smartphones are vulnerable to secret tracking cookies through an inaudible data transmission channel. This is possible through ultrasonic sounds, which exchange information via microphones and loudspeakers (known as “data over audio”).
The St. Pölten University of Applied Sciences (UAS) attempts to expose this hidden monitoring through their SoniControl project—an ultrasound-firewall for smartphones and tablets. At its core, the mobile app finds acoustic cookies, informs the user, and provides an option to block the tracking.
“The most challenging part of developing the app was to devise a method that can detect different existing ultrasound-transmission techniques reliably and in real time,” says Matthias Zeppelzauer, senior researcher in the Media Computing research group of the Institute of Creative\Media/Technologies at St. Pölten UAS, and leader of the SoniControl project.
Ultrasonic signals can be used to track a person’s behavior across multiple devices through “cross-device tracking.” Profile information can be merged together for internet filtering and targeted advertising. Until now, it has not been possible to block those acoustic cookies, according to the researchers.
There is no notification to inform users when monitoring occurs over this channel. To help prevent this situation, the phone’s microphone can be permanently deactivated, however, that would make the telephone feature inoperable.
“In order to accept voice commands, the mobile phone microphone is often permanently active. Every mobile application that has access to the microphone as well as the operating system itself can at any time without notice: activate the microphone of a mobile device, listen to it, detect acoustic cookies, and synchronize it over the internet,” says Zeppelzauer.
This is where SoniControl comes into play. To block and mask ultrasonic data transfer, the mobile device’s loudspeakers send interference signals. The process neutralizes the acoustic cookies, which prevents other mobile apps and operating systems from gaining access.
“There is currently no technology on the market that can detect and block acoustic cookies. The application developed in this project represents the first approach that gives people control over this type of tracking,” says Zeppelzauer.
The project results and application are publicly available.
A follow-up study has recently been launched, known as SoniTalk. Its main mission is to develop an ultrasonic communication protocol that’s transparent, open-source, and fully private-sphere oriented.
