https://nakedsecurity.sophos.com/2021/06/18/can-you-blow-a-pc-speaker-using-only-a-linux-kernel-driver/ Skip to content [naked-secu] by * Products * Free Tools * Search * Free Sophos Home [ ] Go [2F4785DE8C] XG Firewall Next-Gen Firewall [27111765D6] Intercept X Next-Gen Endpoint * [sophos-clo]Sophos Cloud Optix * [08EA66123F]Sophos Central * [678FE99485]Sophos Mobile * [01B80E7D7C]Intercept X for Server * [BEBD9C41BB]Secure Wi-Fi * [DC9D1A7BA3]Phish Threat * [8F51F06B62]SafeGuard Encryption * [597ADA0AF0]Secure Email * [8CB72BF5E1]SG UTM * [C586E37269]Secure Web Gateway [3376DF5742] For Home Users Sophos Home protects every Mac and PC in your home Learn More [A]Free Security Tools [F]Free Trials [5]Product Demos Have you listened to our podcast? Listen now Can *YOU* blow a PC speaker using only a Linux kernel driver? 18 Jun 2021 16 Linux [amp11-1200] Post navigation Previous: S3 Ep37: Quantum crypto, refunding Bitcoins, and Alpaca problems [Podcast] by Paul Ducklin * * * * We don't often put out programming appeals on Naked Security, especially when the code that we're looking for is dangerous and destructive. But this time we're prepared to make an exception, given that it's a rainy Friday afternoon where we are, and that this issue is now in its fifteenth consecutive year. Our attention was drawn to the problem by a tweet from well-known Google cybersecurity researcher Tavis Ormandy, who tweeted today to say: The legend continues, the question was posted for the 15th consecutive year today! https://t.co/NkTngOopoY -- Tavis Ormandy (@taviso) June 17, 2021 With just one exception that I know of (an email that appeared in July in 2008), the same person has emailed the Linux Kernel Mailing List (LKML) sometime in the month of June, ever since 2007, to ask the same question Every year for 15 years in a row, including 2021, the mysterious R.F. Burns (yes, we think it's a pun, too) has wanted to know: From: "R.F. Burns" To: linux-kernel@vger.kernel.org Subject: PC speaker Date: Mon, 14 Jun 2021 23:32:32 -0400 Is it possible to write a kernel module which, when loaded, will blow the PC speaker? Despite many helpful and not-so-helpful answers each year, the mysterious questioner still doesn't seem to have figured out how to do the job. A tongue-in-cheek exchange at the very first time of asking explains the reason for the potential cybervandalism as follows: I am helping a small school system with a number of Linux workstations. Previously, the students (middle and high schools) abused the sound cards in the systems. This was remedied by changing the permissions on sound devices so that non-root users would be denied access (something easily done remotely, and on an automated basis.) At that point, the students started finding creative ways to abuse the PC speaker, which became rather distracting. We unloaded and disabled the PC speaker kernel module, which remedied the situation for a while. So, the idea was raised about seeing if there was a way to blow the PC speaker by loading a kernel module. If so, a mass-deployment of a kernel module overnight would take care of the PC speaker problem once and for all. OTHERS STOP AT NOTIFICATION. WE TAKE ACTION Get 24/7 managed threat hunting, detection, and response delivered by Sophos experts Learn more Is a PC speaker the same as a laptop speaker? Ironically, modern laptops don't really have PC speakers any more. Sure, they have speakers built in, but they're connected up to the sound card that's also build in, so they merely provide a low-quality version of the same sound output you'd hear if you plugged in headphones. But those are just speakers, not specifically a PC speaker, which wasn't connected to a sound circuit at all. The original PC speaker was only ever intended to be used to make beeps to alert you to some sort of error, notably during startup when the screen might not be working and you wouldn't be able to see any error messages that might have been displayed. Back in the day, most PC components ran at 5 volts DC, and the speaker was no different: it was connected to a 5V supply on its positive terminal and earthed (grounded) on the other. The 5V input wire could be turned on and off via an otherwise unused bit in the keyboard controller (bit 1 of port 0x61, in case you want to try writing your own PC speaker code). If you wrote a value of 1 into the speaker control bit, the speaker magnet would actuate and the speaker would jump to its "energised" position. Set the bit back to zero and the speaker cone would move back to its "silent" position. Flip that magic bit on and off at a suitable frequency and you would effectively create a square wave of constant pitch and volume. Vary the frequency every so often, and you could vary the pitch to play rudimentary tunes, and when we say rudimentary, we really mean it. Hacking PC speakers to speak But rudimentary wasn't good enough for gaming hackers. As well as controlling the speaker directly via what's known as bit-banging (where you directly program a control wire by writing a timed stream of 1s and 0s to it yourself), you could also connect the speaker's voltage wire up to the PC's programmable interval timer (PIT). Then, you could vary the pitch of the sound that came out by reprogramming the PIT every so often, meaning that you had more precise control of the speaker's frequency, and you didn't need to have code running in a tight loop just to generate the bit-flips needed for a specific note. Instead, you could dedicate what little CPU power you had at your disposal to tweak the PIT continuously to drive the speaker at varying frequencies, including ones faster than it could actually handle, given that PC speakers were both tiny and tinny and could reproduce only a narrow frequency band. Instead of producing a very high frequency at a constant volume, the electromechanical limitations of the speaker - basically, its inertia, or lag in starting to move when energised - meant that it wouldn't have time to describe a full square wave at all. In this way, you could produce controlled sounds at a lower volume that normal, so you could simulate a sound card that supported, say, 6-bit (64 different sound levels) or even 8-bit (256 different levels), instead of having a speaker that could only reproduce 1-bit sound (playing at full volume or totally silent). By this method, a crude form of pulse width modulation, early PC games achieved astonishing results without sound cards. Many games of the DOS era could not only play back music that sounded way better than the mere sequence of square-wave beeps that the speaker was designed to produce, but even reproduce human speech, though it was often hard to understand or sounded as if the narrator had a really weird and nasal accent. What to do? So, could you actually blow a PC speaker if you had the sort of precise control over it that you would get at Linux kernel level? As our legendary questioner keeps asking, could you blow a PC speaker with a kernel driver? Volume alone, the means by which many a cheaply powerful-but-clippy amp turned too high for too long in student digs has ruined many a set of not-quite-as-highly-rated-for-power-as-you-thought-they-were speakers, isn't going to do the trick. The PC speaker is supposed to run at a constant volume, based on that on-or-off 5V input wire, so it's intended to operate in a "turned up to 10" state all the time. There's no way to turn that 5V input to 5.5V, which would be the same percentage increase as turning it up from 10 to 11, and blow the speaker that way. You can trick the speaker into running at a lower volume that it thinks, and therefore to produce better sounding output by effectively turning it down below 10, but you can't turn it up above 10. You could try to freak out the speaker by running it through a carefully-constructed cascade of frequencies that would tax its physical resilience, except that the PC speaker almost certainly isn't good enough to notice, let alone to reproduce reliably enough, the complex and chaotic physical motion you had in mind. One tongue-in-cheek but helpful responder to R.F. Burns (we're now as good as certain that the name is part of the joke), in the first year of asking, suggested that it might be possible to find a specific frequency for each speaker at which you would cause resonance, and get it to shake itself to bits. Resonance is the sort constructive interference that old vehicles tended to experience at certain speeds, when body panels or window glass would start to vibrate in exagerated and ever-increasing and brain-jarring sympathy with the engine until you sped up or slowed down a tiny bit. Is it possible? Can it be done? We're pretty sure it can't, or else R.F. Burns (now we know it's a joke it's not really funny any more) would surely have figured out the magic frequency in the past 14 years, and stopped asking how to do it. So, if it can't be done, this question must, surely, have a hidden meaning... ...but what is that hidden meaning? Answers below, please! --------------------------------------------------------------------- * Follow @NakedSecurity on Twitter for the latest computer security news. * Follow @NakedSecurity on Instagram for exclusive pics, gifs, vids and LOLs! Free tools Sophos Home Sophos Home Protect personal PCs and Macs Hitman Pro Hitman Pro Find and remove malware Sophos Intercept X for Mobile Intercept X for Mobile Protect Android devices Post navigation Previous: S3 Ep37: Quantum crypto, refunding Bitcoins, and Alpaca problems [Podcast] 16 comments on "Can *YOU* blow a PC speaker using only a Linux kernel driver?" 1. [188975] Gary says: June 18, 2021 at 6:16 pm Duck, Perhaps this might be where the "R.F. Burns" comes from in this context: https://ieeexplore.ieee.org/document/5618607, seeing as the poster is asking how to blow a speaker. Reply + [025c4b] Paul Ducklin says: June 18, 2021 at 6:57 pm Good find! But that paper was published three years after our RF Burns first asked his non-electromagnetic question. Reply 2. [c33b28] Jeff says: June 18, 2021 at 6:37 pm The highest stress I can think of would be to write the value of 1 into the speaker control bit to actuate the speaker magnet would actuate, and leave it there. At that point your running 5 volts DC into the dynamic speaker coil, which will maximize the current flowing through the coil (no inductive resistance since it's DC rather than AC). As long as the 5 volt supply circuit can actually supply the full 5 volts continuously, the power dissipated in the coil will depend on the resistance through the coil. Assuming an 8 ohm speaker, which is rated based on AC impedance, the DC resistance will typically be in the 5-7 ohm range, and the power dissipated will be in the 0.7 to 1.0 watt range. The original IBM-PC speaker's specification's was an 8 ohm, 0.5 watt speaker. So dumping 0.7 to 1.0 watts of power would have a reasonable chance of causing damage to the coil (blowing it out) over a fairly short period of time, perhaps within a few minutes. Reply + [025c4b] Paul Ducklin says: June 18, 2021 at 7:00 pm I guess that "melting" or "burning out" a speaker is equivalent to "blowing" it. I always assumed that the speaker's resistance was chosen (or adjusted with a resistor of its own - would that do the trick?) to prevent it being overloaded in this way. Reply o [c33b28] Jeff says: June 18, 2021 at 9:54 pm In a traditional audio system design, a speaker's impedance (it's DC resistance plus the reactance to the AC being fed to it) is chosen to match the amplifier. For simplify, this is normally referred to as the speaker's resistance. Using a speaker lower in resistance (impedance) relative to the amplifier's design can draw too much power from the amplifier, causing damage to the amplifier. You can buy speakers with the same resistance rating but with different wattage capacities. So if you had a 100 watt amplifier designed for an 8 ohm speaker, and connected an 8 ohm 100 watt speaker and cranked the volume, all is good (and pretty loud). But if you connected a 8 ohm 10 watt speaker to that same amplifier and cranked the volume, you'd pass more current through the speaker's coil than it could handle, and burn it out. Reply + [03a8f8] Wilderness says: June 18, 2021 at 9:12 pm Is the supply current limited? Reply 3. [03a8f8] Wilderness says: June 18, 2021 at 6:38 pm I think it's a question that's long past its utility (As you note; modern machines don't have 'PC speakers' in them, and it would have been trivial to just go through and physically remove them decades ago, since they're not necessary for normal operation) but it has become more than that now. Mr. Burns has gotten obsessed with the idea and keeps posing the question in the hopes that someone has figured out something. Given the ruggedness of the little speakers and the limited amount of power available to drive it, I personally don't believe there is a way to blow numerous speakers. One might possibly be able to find a way to blow one specimen out of a thousand, but each speaker is different, so it's unlikely that one 'magic frequency' can be found that would blow nearly any speaker. Reply + [025c4b] Paul Ducklin says: June 18, 2021 at 7:08 pm Seriously, you're saying this question is LONG PAST ITS UTILITY? I don't mean to be rude, but THAT SORT OF PRACTICALITY AND REALWORLDLINESS IS SIMPLY NOT ACCEPTABLE :-) Heck, next people will be wondering, "What's the point of porting Doom to run on an IKEA digital light bulb?" (Someone more or less just did that.) This reminds me of an episode of Big Bang Theory where Dr Sheldon Cooper has one of his online gaming accounts hacked and someone steals Glenn, his trusty Battle Ostrich. Sheldon is most upset at his loss, and even more upset at the disinclination of the LA Police to issue an immediate APB. "3000 hours! 3000 hours clicking on that mouse, collecting weapons and gold. It's almost as if it was a huge waste of time." Reply o [03a8f8] Wilderness says: June 18, 2021 at 9:11 pm Reply o [1de7da] R.Dale Barrow says: June 18, 2021 at 9:41 pm They've ported Doom to an IKEA digital light bulb? I SIMPLY MUST HAVE A COPY!! C'mon Duck, don't hold out on us. THE WORLD NEEDS THIS!!. Reply # [025c4b] quest says: June 18, 2021 at 10:40 pm Hmmm. You can read the story here, inter alia: https://www.theverge.com/2021/6/14/22533512/ doom-ikea-tradfri-smart-light-bulb-hack But the original videos and writeup by the hacker who alleged they did it were apparently removed on request (no reason given) earlier this week: https://www.reddit.com/r/itrunsdoom/comments/nys0bv/ doom_running_on_an_ikea_tr%C3%A5dfri_rgb_gu10_lamp/ h1tnx4z/?context=3 Reply 4. [dd3507] Paul Martin Mrozinsky says: June 18, 2021 at 7:42 pm With the speaker attached to a USB port the issue expands from USB 2.0 at 500ma current draw over a USB type-1A black tab (1/2 inch wide) connector or a USB Micro type-B connector found on the older cell phones; to USB 3.1 at 900ma over a USB Type-1A blue tab (1/2 inch wide) connector or a USB Type Type-C connector. You most check your speaker before you connect it for it's current rating at 5 volt DC. If your computer's USB restricts the current draw to protect the port and it's electronics, as there are no fuses here, your speaker's volume will be restricted. But if your computer does not restrict the the USB current draw by the speaker then your computers' USB ports and their electronics could be damaged by an over-draw of current on the 5 volt DC power to the port. USB ports were not designed as 5 Volt DC power switching devices. Vendors are manufacturing miniature devices that are powered by low current 5 volt DC that state you could plug these into your USB ports and providing you with a USB cable. Check your USB ports; are they USB 2.0 with USB Type-1A with a black tab (1/2 inch wide) at 500ma, or USB 3.1 with USB Type-1A with a blue tab (1/2 inch wide) or a USB Type-C connector at 900ma. Reply + [025c4b] Paul Ducklin says: June 18, 2021 at 7:53 pm These "PC speakers" are wired onto the motherboard, and predate USB by about 15 years... you really do only have that one 5V control line, and a bit in the keyboard port that sets whether it's 5V or 0V. Reply 5. [7f073c] Raymond E Rogers says: June 18, 2021 at 7:43 pm Hey! That type of crime is serious, as documented in: https://best-sci-fi-books.com/ review-halting-state-by-charles-stross/ Reply 6. [103101] Peter says: June 18, 2021 at 9:32 pm It sets his slow clock rate ...synchronizes, if that sounds appropriate to these frequencies .. OR He is (a) SPY and this is one of his Dead Letter Box type messenging protocols. OR He (or other) is DEAD, and like a LOYAL DOG, his pet service continues to send out the light house bleeps redolent of the living creature. Sort of pulsar. OR It is a doorway into another portal, hinting at infinite mirroring and looped Black-Cat style somewhat worrisome images suggestive of potential normally-unseen dimensions of existence. Or stuff in fewer words. OR (H0)........... ............................. It's simply that The Creature has been close to Oooer Nige : By the way ... where is Nige? .......maybe lubricating the path of CV19#n4PS Reply + [025c4b] Paul Ducklin says: June 18, 2021 at 10:36 pm Some have suggested it's a "canary", where if the message *stops* arriving, it conveys a meaning of some sort. (That's a trick that can has been used in the past to circumvent rules than say you are legally prohibited from announcing that X has happened, for example when X is "here is a warrant demanding you to reveal user data for all your customers, but you must not warn them". The so-called "warrant canary" works the other way around, by regularly announcing that X has *not* happened, and then suddenly cutting the announcements if it does. Thus the "canary" tells you that a warrant has been received by *not* sending any message, therefore complying, in theory at least, with the letter if not the spirit of the law.) Once a year, however, seems a bit infrequent for a message canary of that sort. Reply What do you think? Cancel reply [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment [ ] Name [ ] Email [ ] Website [ ] [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] Recommended reads Mar22 by Paul Ducklin 0 Naked Security Live - "XcodeSpy" takes aim at Mac and iOS developers Apr22 by Paul Ducklin 45 Linux team in public bust-up over fake "patches" to introduce bugs Apr22 by Paul Ducklin 0 S3 Ep29: Anti-tracking, rowhammer problems and IoT vulns [Podcast] * About Naked Security * About Sophos * Send us a tip * Cookies * Privacy * Legal * Intercept X * Intercept X for Server * Intercept X for Mobile * XG Firewall * Sophos Email * Sophos Wireless * Managed Threat Response * Cloud Optix * Phish Threat * * * * * (c) 1997 - 2021 Sophos Ltd. All rights reserved. Powered by WordPress VIP