[HN Gopher] How I discovered a hidden microphone on a Chinese Na...
___________________________________________________________________
How I discovered a hidden microphone on a Chinese NanoKVM
Author : ementally
Score : 334 points
Date : 2025-12-06 13:54 UTC (9 hours ago)
(HTM) web link (telefoncek.si)
(TXT) w3m dump (telefoncek.si)
| kotaKat wrote:
| https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction...
|
| Probably an older NanoKVM.
|
| "NanoKVM-Cube hardware is built on the LicheeRV Nano platform. To
| coordinate production and maintain consistency with the LicheeRV
| Nano for the SMT project, the hardware retains the display,
| touch, MIC, and amplifier circuits. To address potential privacy
| concerns, versions 2.2.6 of the application and 1.4.1 of the
| firmware and above will remove the relevant drivers. We will also
| eliminate these components in future productions."
| tayiorrobinson wrote:
| To be fair, the microphone _is_ listed on the specsheet of the
| LicheeRV Nano
|
| https://wiki.sipeed.com/hardware/en/lichee/RV_Nano/1_intro.h...
|
| I assume they didn't intend to put a mic on the KVM product, but
| they wanted to make a KVM product, already had this SBC product,
| which reusing their existing stock of helped keep cost low.
|
| Should they have been more up front about it it? Sure, and it's
| not great that they had a bunch of security issues in the FW
| anyway, so not exactly great, but "hidden microphone in a Chinese
| KVM" lets the mind wander
| ndsipa_pomu wrote:
| It doesn't strike me as that useful to have a hidden microphone
| in a KVM product as most of the time, they're going to be stuck
| in server rooms with just lots of fan noise to record.
|
| Far more of an issue would be any kind of keylogger built into
| the software, which is why it's best to go for devices that
| support open source software.
| i_am_proteus wrote:
| It is possible to keylog via audio.
|
| https://ieeexplore.ieee.org/abstract/document/10190721
| BenjiWiebe wrote:
| But the point of a device like this is that you (and your
| keyboard) are NOT physically present.
| hinkley wrote:
| They mean the K in KVM could trivially have a keylogger.
| For the computers attached to that KVM. Audio is for
| logging for computers _not_ attached to the device in
| question. Which could be up to and including a whole
| server room save a couple machines.
| ErroneousBosh wrote:
| A long time ago (maybe in the mid-90s) I knew an elderly
| radio amateur who could not just "copy" CW by ear, but also
| RTTY. He could also pretty much tell what a teleprinter was
| printing just by listening to the noises it made, like he'd
| be facing away from it on the other side of the room
| reading out entire words from what was coming through.
|
| Apparently in the 50s when he did his National Service he'd
| been in the Signals but "not in the regiment that's on his
| papers", make of that what you will.
|
| I have noticed that with PSK modes and particularly PSK31
| you can hear "CQ CQ CQ" as a distinctive pattern much in
| the same way as it is with CW.
|
| IBM spent a fortune developing ATM keypads that - when
| correctly mounted - had keys that made the exact same noise
| no matter how you pressed them or how worn they were.
|
| So I don't doubt that someone suitably clever could extract
| audio from a room and work out what was being typed.
| f1shy wrote:
| Do you have a pointer to learn more about the ATM
| keyboards? I would love to learn more about it
| ErroneousBosh wrote:
| Maybe. They were necessarily very cagey about it back
| then, but I might have some documentation kicking about
| in storage. I tended to keep copies of every service
| manual I could get my hands on back then.
| CamperBob2 wrote:
| One really-cool way to solve that problem is to embed a
| 7-segment LED under each keycap. You walk up to the
| keypad and the 0-9 digits appear in random order. No one
| can shoulder-surf, look for wear or IR emission from the
| buttons, or train on the click sounds.
|
| Dell had those on every lab door in the building back in
| the early 90s. You felt like 007 every time you punched
| in your access code. I've never seen them anywhere since.
| NoMoreNicksLeft wrote:
| And now days I can't put in my card's pin without 10
| overhead cameras aimed at the register area. All the
| cameras of which are network-connected, video stored
| persistently, and high res/fidelity enough to here the
| little beeps as I press the keys, and to know that I've
| hit the enter because the screen indicates it
| immediately. But then Dell cared about its own security,
| and the grocery store doesn't give a single shit about
| whether my life is ruined by identity theft.
| seszett wrote:
| It would take an especially perverse mind to keylog using
| audio _on a KVM_ , though. The KVM basically has access to
| everything, any secondary spying using a microphone or a
| camera would provide very little added value.
| saltcured wrote:
| Maybe it's for the super secret stuff that the datacenter
| emergency ops worker knows not to type through the KVM?
| ;-)
| Y_Y wrote:
| _just_ fan noise?
|
| https://arxiv.org/abs/1606.05915
|
| Any signal that you can modulate can be an exfiltration
| channel, and fan noise is no different.
| ndsipa_pomu wrote:
| I wonder if that's feasible in a room filled with many
| servers and fans going?
| runjake wrote:
| Yes, just modulate the fan noise on the transmitter, and
| apply a filter on the receiver.
| overfeed wrote:
| > Any signal that you can modulate can be an exfiltration
| channel, and fan noise is no different.
|
| This KVM has HDMI input and can directly emulate USB mass
| storage; fan-modulation is the lowest-bandwidth
| (side-)channel available to the attackers.
| nine_k wrote:
| You can exfiltrate data from a machine which is _not_
| connected to the KVM. A high-security machine may be even
| air-gapped most of the time, but be physically nearby.
| close04 wrote:
| I don't think too many of these devices will end up in
| server rooms as opposed to home labs. And the ones that
| do end up in a datacenter are _very_ unlikely to be
| allowed to ever reach the internet.
|
| If the microphone was used for exfiltrating data, it
| would work against random targets that happened to let
| the KVM connect to the internet, and who have a nearby
| machine infected with some malware. That kind of non-
| targeted attack can be damaging but is semi-useless to
| the attacker.
| PunchyHamster wrote:
| The KVM just uses a devboard that's also sold separately and
| just happens to have a microphone, given how cheap the mics
| are having one extra SKU would probably just cost them more
| than savings.
|
| Also I wouldn't _really_ consider it "server room" product.
| Pretty much any new server has KVM, this is more "a hobbyist
| needing KVM for their home server"
| hinkley wrote:
| Ultrawideband never caught on because it turns out that the
| speed of light and sound in air is frequency dependent, so
| you have to know the distance to the target pretty accurately
| and then skew the signal to send or receive. (Imagine a
| phased array antenna but also with a frequency domain to work
| out as well).
|
| But that doesn't mean you can't make it function in a loud
| server room. The whole point of it is working in and around
| noise.
| parineum wrote:
| The Chinese part makes one think the Chinese could access the
| microphone.
|
| Nevermind that, if they could access the device, they'd also be
| able to read your kvm i/o.
| motbus3 wrote:
| You might be right but I think we cannot assume malice when
| it could be laziness. It might be that the exact same board
| has multiple target audiences and they just rebrand it for
| different purposes with different pricing.
|
| That said, the microphone is so weirdly positioned that it
| gets suspicious indeed.
| inetknght wrote:
| > _I think we cannot assume malice when it could be
| laziness_
|
| Why can't it be both?
| calmworm wrote:
| Perception of laziness with an option for later
| maliciousness and somewhat plausible deniability.
| Ekaros wrote:
| >That said, the microphone is so weirdly positioned that it
| gets suspicious indeed.
|
| How is it weirdly positioned? To me it seems there is
| rather few options for such small board.
| b00ty4breakfast wrote:
| > I think we cannot assume malice when it could be laziness
|
| If you are too lazy to go back and check if you left the
| gas on, you bear responsibility if the place explodes.
|
| At the very least, it's negligent to leave something like
| that in and not be very upfront about it.
| TheRealPomax wrote:
| And rather than "the Chinese", how about "anyone robo-
| dialling some SSH connections"?
| hinkley wrote:
| Microphones and LEDs have been used famously for side channel
| attacks and also to circumvent air gaps. From a Least Power
| point of view this is troubling.
| Rygian wrote:
| "hidden microphone in a Chinese KVM" is the correct way to
| describe what is going on.
|
| "Reusing existing stock" is not a valid excuse. They are
| currently selling this device without advertising that it
| contains a working microphone.
| mintplant wrote:
| A working microphone _and_ recording software _and_ hacking
| tools like aircrack-ng on an otherwise stripped-down OS
| image...
| LorenPechtel wrote:
| Given it's history I suspect there is nothing malicious going
| on here, just a Chinesium approach to building something.
| Security isn't documented so it's made of tissue paper.
| mannanj wrote:
| any speaker can be tapped into as a microphone by a motivated
| government.
| Aachen wrote:
| From a hardware point of view I've also noticed that speakers
| work like poor microphones (and LEDs like poor solar panels /
| light sensors), but is there any way to actually make this work
| on most devices without physically changing wiring? If the
| circuits aren't made to take measurements (or the software
| can't get at the readings) but only set a voltage on the wires,
| there wouldn't be a way to (ab)use this. I don't know enough
| about electronics to know whether this is commonly the case
|
| Not that it's not a good thing to be aware of, but do you have
| any sort of source for what kinds of devices can have their
| speakers turned into microphones? Then I'll believe you about
| the government part
| withinboredom wrote:
| I don't think they meant literally "any" but more like a
| device with a speaker could be delivered to you that has a
| speaker/microphone. Like a Bluetooth speaker you order of the
| internet. It seems it would probably have to be personally
| targeted to you, but in that case, there are probably simpler
| ways.
| stragies wrote:
| Many a soundcard supports changing jack "direction". Here's a
| StackExchange answer from 2012, on how to do it with the GUI
| tool `hdajackretask` : https://askubuntu.com/a/911961
| mannanj wrote:
| Any was an exaggeration and less than honest on my part, I
| apologize. I think the speakers in most smart devices though
| can because they have the circuitry as another comment
| mentioned to record the input in reverse via software.
|
| I think most speakers would have that today, most modern
| speakers. Plain speakers that just take a voltage signal
| though, probably not. Though how many people use those kinds
| of speakers today I wonder.
| Workaccount2 wrote:
| No, because the drive circuit for a speaker is the opposite of
| the circuit for a microphone. The output stage of a speaker
| amplifier is just that, an _output_. The only way to record
| audio from a speaker, which is totally possible, is to have
| also purposely built an input stage also attached to the
| speaker. Which at that point you might as well just use a
| microphone...
|
| Audio input and output _are not_ reversible.
| Y_Y wrote:
| I don't know what you mean here, I can plug a speaker into my
| mic slot and use that to record, just as plugging a mic into
| the speaker slot gives a (crappy) speaker.
| cdaringe wrote:
| > purposely built input stage
|
| You moved your device to the purposely built input stage.
|
| Not an expert, but your remark doesn't compute with the
| parent comment
| Workaccount2 wrote:
| Because on your computer the engineers purposely put a
| switch that can direct the signal to either the input
| hardware or the output hardware.
|
| It's not a mic slot, it's a general analog I/O port with a
| 3.5mm form factor.
| 15155 wrote:
| A DAC and amplifier circuit is electrically incapable of
| processing input (on its own.)
|
| Physically unplugging and moving a speaker to a mic input
| works, sure, but very few devices can do this switching
| electronically.
| stragies wrote:
| on many cards they are, check out the tool `hdajackretask`
| from package `alsa-gui-tools`.
| Milpotel wrote:
| > [...] and runs a heavily stripped-down version of Linux that
| lacks systemd and apt. And these are just a few of the issues.
|
| ?!
| stefan_ wrote:
| > But what additionally raised red flags was the presence of
| tcpdump and aircrack - tools commonly used for network packet
| analysis and wireless security testing. While these are useful
| for debugging and development, they are also hacking tools that
| can be dangerously exploited.
|
| Must be another AI slop article. Stop feeding your writings
| into GPT & co to turn into extra long nonsense.
| kenjackson wrote:
| What was wrong with the above paragraph?
| nottorp wrote:
| Let's see:
|
| 1. It lacks systemd and apt.
|
| systemd is so resource hungry that i'm sure they removed it
| to reduce the RAM bill. Apt... why install apt if the
| distro has a different means of updating?
|
| 2. While these are useful for debugging and development,
| they are also hacking tools that can be dangerously
| exploited.
|
| This is purely fear mongering. Even the shell could be a
| "hacking tool that can be dangerously exploited". Let's
| remove the shell too.
|
| There are some legitimate complaints in the article, like
| the use of the same key on all installs. The rest looks
| more like fear mongering and security theater.
|
| Including the microphone. What were they supposed to do,
| desolder it manually and add $10 to the price of each
| device?
|
| I don't see the article complaining that a PiKVM has so
| many unused peripherals when used as a KVM. To go in the
| spirit of item #2, the usb ports _could_ be used as
| "dangerous hacking tools" so you should desolder your usb
| ports from a Pi used as a KVM, right?
| mystraline wrote:
| Cat is a hacking tool cause you can see the contents of
| /proc/kcore?
|
| Cp is a hacktool cause bad files can be copied?
|
| Grep is a hacktool cause only monster hackers use regex?
|
| (This is obvious sarcasm)
| f1shy wrote:
| Heck, everybody knows Linux is a hacker OS...
| nottorp wrote:
| Hey I didn't think of that. They forgot to complain that
| the device doesn't use a properly licensed OS that they
| certified secure!
|
| Absolutely with systemd and apt. Like apt couldn't be
| used to install "hacking tools".
| whalesalad wrote:
| I don't see this as noteworthy myself. It's expected on a small
| embedded device such as this. You're usually lucky to have
| busybox.
| kps wrote:
| Presumably Alpine. I bet it doesn't run GNOME either. And these
| are just a few of the issues!
| lousken wrote:
| is there a recording sample to hear the quality?
| jlward4th wrote:
| I recently discovered a similar concerning security issue with my
| KVM. In my case it was a pretty standard KVM for multiple
| machines to share a keyboard, mouse, and screen but also
| Ethernet. One day while looking at my home network I noticed the
| KVM had its own IP and was transferring GBs of data everyday. I
| quickly blocked it from my network. But having used it for a
| number of months I worried that with screen capture and access to
| all my input devices, someone could have gotten access to pretty
| much everything I use. I wasn't able to figure out if any data
| was actually being sent off my network and I really didn't want
| to put myself in any more risk so I just threw it in an
| electronics recycling bin. Pretty scary what a network connected
| KVM could maliciously do.
| Renaud wrote:
| Shame you threw it away. It would have been useful to collect
| the traffic with Wireshark and share that with info about the
| device in a post or a blog for others to investigate and be
| warned about that brand and model.
| stragies wrote:
| Why did you not just login to the device, and switched off
| "Broadcast to multicast", or changed the destination address?
|
| Edit: Some brands of Network-KVM use this, so that you can
| control the target device from another device, like e.g. an App
| on a tablet. That way you don't have to stand next to the
| target device in the noisy and cold machine room
| jlward4th wrote:
| The KVM didn't have any documentation on anything related to
| its network interface. I ran a port scan on it but didn't
| know if there was a way to log into it.
| CoastalCoder wrote:
| Is it possible for you to name the KVM model?
|
| It sounds like a potential risk is to the public.
| jlward4th wrote:
| It is this one: https://www.amazon.com/dp/B0CP4PD3SM
|
| I did post a review there citing my security concerns.
|
| Honestly I didn't go further with the investigation because
| if someone really has all my data, I'm worried about
| retribution.
| stragies wrote:
| Was the network port bridged to both PCs all the time (as
| the description makes it sound, or did only the "active" PC
| get a functioning network connection? Could you tell from
| the FDB of the upstream device, if there were more than two
| MAC addresses active on the port? Did you (hopefully) open
| it up and make PCB pictures before chucking it?
| supportengineer wrote:
| What an amazing device, but also the price is incredible. This
| kind of device would have been such a game changer 15 to 20 years
| ago. Thank you for the detailed security analysis. At least the
| developers are responsive, that does seem like a green flag.
| bethekidyouwant wrote:
| If someone hacks your KVM, I'm thinking the onboard microphone is
| the least of your problems.
| _def wrote:
| Anyone got a link to some community work on the open source side?
| Sounds like useful devices, if you fix the issues mentioned.
| gunalx wrote:
| I dont see the issue here. Its not like they have not disclosed
| what board it is based upon. And I do feel like its correct not
| advertising a mic if you dont have it enabled on this one.
|
| I dont really like nanokvm for being slow with updates and not
| patching stuff fast enough.
| pirbull wrote:
| > You can start with your iPhone - last year Apple has agreed to
| pay $95 million to settle a lawsuit alleging that its voice
| assistant Siri recorded private conversations. They shared the
| data with third parties and used them for targeted ads.
| "Unintentionally", of course! Yes, that Apple, that cares about
| your privacy so much
|
| the clickbait title makes sense after reading this paragraph
| gruez wrote:
| Not really, because the paragraph you quoted was highly
| misleading. Even the plaintiffs admit that the recordings were
| caused by accidental activation, not some sort of nefarious
| conspiracy by Apple. Moreover there's no evidence that Apple
| "used them for targeted ads", only that they handed over to
| third party contractors for improving siri.
| LorenPechtel wrote:
| And Siri promptly got disabled on my wife's iPad because she
| kept triggering it inadvertently. Something about her accent
| kept tripping it. (And, in reverse, Alexa will often not
| trigger when my wife tries. She comes from a tonal language
| and it creeps into her English extensively.)
| jxhdh wrote:
| You are using a KVM. When not trusting the manufacturer a
| microphone is the least of your problems xD
| pixl97 wrote:
| This said wildly inappropriate features included do violate the
| principle of least user authorization. You expect if your KVM
| gets hacked your servers are pretty fucked, the problem now is
| any conversation you had by the KVM is suspect too.
|
| Goes along with 'the S in IOT stands for security'.
| snapdeficit wrote:
| A kvm that requires Chinese dns servers? Just the fact it KvM
| over Ethernet should set off alarm bells from here till next
| Thursday. I would have a hard time trusting an internet based
| kvm.
| macki0 wrote:
| wait till you find out about iLO/iDRAC or vPro
| Ekaros wrote:
| Should I really be more trusting of some NSA controlled DNS
| server?
| snapdeficit wrote:
| Yes. Hahaha. Of course not. Or maybe?? No, just kidding. But
| am i?
| ghostpepper wrote:
| A lot of the complaints here don't make a lot of sense and read
| like the author has never used an embedded linux device. The
| previously reported bugs are more substantial - hardcoded secrets
| for JWT access and firmware encryption, everything running as
| root, etc.
|
| However, "Chinese product uses Chinese DNS servers and it's hard
| to change them" or "no systemd nor apt installed" are totally
| expected and hardly make it "riddled with security flaws". Same
| with tcpdump and aircrack being installed - these hardly
| compromise the security more than having everything run as root.
|
| I would expect most users of this device will not be exposing the
| web interface externally, and the fact that they ship with
| Tailscale installed is actually impressive. I can't imagine the
| lack of CSRF protection will be a vulnerability for 99% of users.
|
| I am curious what the "weird" version of wireguard the author
| refers to but based on their apparent lack of knowledge on
| embedded systems in general I would not be shocked to find that
| it's totally innocuous.
| itopaloglu83 wrote:
| Hanlon's Razor at work; most of the shortfalls described in the
| article points to incompetence more than malice.
|
| Though I find it strange though, because I would call this the
| shortcomings of a crowdfunded project, but the author took it
| as a malicious and planned act to take over target computers
| and networks.
|
| As far as I remember, some of the botnets are formed by routers
| that vendors refused to patch, because they're no longer being
| sold and not profitable to do so.
| butvacuum wrote:
| I think you haven't gone far enough. Most of this thread is
| rampant ignorance and propaganda influenced bandwagoning.
|
| 1) It's from a company known for dev boards and SoCs- not
| consumer products.
|
| 2) The code is available on GitHub (nice!)
|
| 3) SiSpeed actively contributes to the mainline linux kernel
| for RISC-V in general as well as their SoCs.
|
| 4) Security in Embedded Applications is just... Bad. Amercian,
| Chinese, European, Russian, Indian- it doesn't matter.
| Ekaros wrote:
| Also what do you really expect for 30EUR or 60EUR price
| point? On relatively low volume product. It even doing what
| is promised is already a good start to me. And that probably
| tells their priorities. Start from some already working image
| with wide support for features. And then add the features
| that are needed in specific use case. And then ship it.
| nickphx wrote:
| yeah.. their list of issues speaks more to their lack of
| experience and understanding of linux and embedded linux
| devices wrapped in xenophobic nonsense...
| unknown_rookie wrote:
| Once I dissected the code of a FDA-approved medical device,
| Vendys Endothelix. If connected to the internet, the device would
| covertly send measurement data to a specific email address. The
| usernames and comments baked in the code suggested Chinese
| development. I would be curious to know what percentage of our
| highly sensitive data ends up overseas.
| SoftTalker wrote:
| I think it's safe (or maybe prudent) to assume that pretty much
| all phones, computers, and network switching gear are
| backdoored by _someone_.
| finaard wrote:
| > To summarize: the device is riddled with security flaws,
| originally shipped with default passwords, communicates with
| servers in China, comes preinstalled with hacking tools, and even
| includes a built-in microphone
|
| So like pretty much any BMC out there, just with the benefit that
| an attacker taking over that thing doesn't have direct access to
| reflash your bios with a backdoored version?
|
| Any halfway sane person deployed any kind of BMC or networked KVM
| to a access restricted management VLAN for at least a decade now
| because all of those things are a big mess, and the impact of
| them getting owned typically is pretty severe.
| da_grift_shift wrote:
| Wow, HN is really desperate for the clickbait today.
|
| (And no! Don't just say this isn't a substantive comment! Do
| better! This isn't the first ragebait top story that made
| commenters foam at the mouth today, and thanks to the bullshit
| asymmetry of AI slop, it's even easier to churn out posts like
| 'this cheap shitbox SBC lacks systemd but includes tcpdump'.)
| neom wrote:
| Gotta be careful about them hidden microphones, they could be
| listening and recording all the keyboard clicks and translating
| them to the device.
| iJohnDoe wrote:
| Such a cool device.
|
| Is it possible to buy something like this which is intended to be
| user installable for Linux that I could test/mess around with?
| PunchyHamster wrote:
| The device is based on linux devboard so... yes
| kyrofa wrote:
| > [It] runs a heavily stripped-down version of Linux that lacks
| systemd and apt. And these are just a few of the issues.
|
| You mean it's not Debian-based? How is this an issue?
| thorncorona wrote:
| Please stop upvoting AI clickbait slop.
| mrbluecoat wrote:
| > The device initially came with a default password, and SSH
| access was enabled using this preset password
|
| That alone ends my trust in the brand.
| PunchyHamster wrote:
| ...you need a password to log in onto it to change it. That's
| hardly unique.
|
| You could say "but they could make random one that is displayed
| on display!", but they also sell headless version with no
| display at all so that's not an option
| wkat4242 wrote:
| Whoa I have a bunch of these.
|
| But I never trusted them in the first place so they don't have
| internet access anyway. They're on a separate subnet. It'll be
| fine.
|
| Also where my servers are there's nothing interesting to hear
| except more servers and 3D printers.
| milesvp wrote:
| Mics have a pretty standard look, and are hard to miss on the
| board. It would be more insideous if there were cheap film caps
| leading into a very expensive ADC. I work with with analogue
| audio, and it's very important to design around the noise of
| cheap caps. They are for all intents and purposes microphones and
| if you were clever about different caps for different frequencies
| and good digital processing I have no doubt you could build
| something with comparable fidelity to some of the cheapers MICs
| in the vocal range.
| rcarmo wrote:
| This is... not news. The base board has always had a microphone,
| the NanoKVM was just built around that base board.
___________________________________________________________________
(page generated 2025-12-06 23:00 UTC)