--- id: CP-095 slug: acoustic-optical-attacks-tempest lang: en title: Acoustic and optical attacks (TEMPEST) description: The sound of keystrokes, the noise of a power supply or an open microphone can reveal what you type or say, with nothing showing on the screen. canonical_url: https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/ markdown_url: https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Acoustic and optical attacks (TEMPEST)", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-073 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/ fr: https://startbrain.io/cyberpedia/fr/articles/attaques-acoustiques-optiques-tempest/ de: https://startbrain.io/cyberpedia/de/articles/akustische-optische-angriffe-tempest/ es: https://startbrain.io/cyberpedia/es/articles/ataques-acusticos-opticos-tempest/ sources: - "n": 1 title: A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards publisher: arXiv url: https://arxiv.org/abs/2308.01074 published: "2023-08-02" accessed: "2026-11-03" - "n": 2 title: "POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers" publisher: arXiv url: https://arxiv.org/abs/2005.00395 published: "2020-05-01" accessed: "2026-11-03" - "n": 3 title: Audio Capture, Technique T1123 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1123/ accessed: "2026-11-03" - "n": 4 title: Video Capture, Technique T1125 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1125/ accessed: "2026-11-03" - "n": 5 title: "Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1056/001/ accessed: "2026-11-03" - "n": 6 title: Device security guidance publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/device-security-guidance published: "2021-06-29" accessed: "2026-11-03" --- # Acoustic and optical attacks (TEMPEST) A side-channel attack spies on a device without breaking into it. Instead of forcing the computer, the attacker listens to what it gives away: the noise of the keys, the sound of a component, sometimes a microphone already open for a video call. Researchers showed in 2023 that a machine learning model recognizes a laptop's keystrokes from their sound [1]. The employee sees nothing: the attack is passive, no window opens, no message appears. This page separates what the sources in the file show in the laboratory from what they describe as a real intrusion technique, and gives simple steps to limit exposure. ## In 30 seconds - Where it happens: near your keyboard, during a video call, or on a computer where malware turns on the microphone or camera. - What the attacker wants: to reconstruct what you type, including passwords, or to listen to sensitive conversations. - The reflex: keep sensitive typing and calls away from microphones and prying eyes, and let the IT teams apply the device security guidance. - If it has already happened: tell IT support if a microphone or camera behaves unexpectedly. ## Straight answers ### Can someone guess what I type just by listening to me? Researchers have done it in the laboratory. They recorded a laptop's keystrokes with the microphone of a nearby phone, then trained a classifier: it recognizes the keys with 95% accuracy [1]. They note that this result is the highest obtained without a language model [1]. ### Is a video call enough? In the same study, keystrokes recorded through the Zoom video conferencing software were recognized with 93% accuracy, a record for this recording method according to the authors [1]. The authors write that their results prove the practicality of these attacks with off-the-shelf equipment and algorithms [1]. ### Is a computer without a speaker safe? Not necessarily. A researcher described in 2020 a malware program that makes the computer's power supply play sounds, with no sound card or speaker [2]. Data can be modulated in these sounds and picked up by a nearby receiver, such as a smartphone [2]. ### Is this a common risk for an employee? The sources in the file describe research demonstrations, not incidents involving employees. The intrusion techniques they document are of a different kind: software installed on the computer that records the microphone, the camera or the keystrokes [3][4][5]. These are the ones that concern the employee first. ### Who should worry about this first? Organizations. The UK's NCSC publishes guidance on choosing, configuring and using devices safely, aimed mainly at professional users and at those responsible for large fleets of IT equipment [6]. ## Inside the attacker's head The attacker has two routes. The first is at physical range: he places a microphone near the target, or relies on a call that is already open, and has the recording analyzed. The 2023 study relies on a phone placed next to a laptop and on the sound transmitted by Zoom [1]. It requires only off-the-shelf equipment and known algorithms [1]. The second route goes through malware. MITRE describes adversaries who use a computer's microphones and cameras, or voice and video call applications, to listen to sensitive conversations [3]. The audio files can be written to disk and exfiltrated later [3]. For video, the technique is similar: built-in cameras or webcams, with images taken at chosen intervals [4]. The most direct goal is the password. MITRE notes that keystroke capture is used to intercept credentials at the moment the user enters them [5]. ## What you see on screen Nothing. In the acoustic attack, the computer is not touched: everything happens in the air, between your keyboard and a microphone. In the power-supply attack, the malicious code runs in a simple user process, with no special privileges or access to the hardware [2]. For audio or video capture, the program goes through an interface (API) provided by the system or by an application [3][4]. The sources give no sign visible on screen. A clue can come from elsewhere: a microphone or camera that turns on when you have started no call justifies a report to support. The useful steps are simple. Keep passwords and sensitive data out of range of a microphone, especially during a call, and mute the microphone when you type. Take sensitive calls in a discreet place. Angle the screen so that it cannot be seen from outside. Apply the configuration rules of your IT teams: the NCSC provides guidance for administrators and for users alike [6]. A computer cut off from the network or without a speaker is not safe for all that: the 2020 study shows this for the acoustic route [2]. Government agencies and companies that handle highly sensitive information have their own protection standards, which the sources in the file do not describe: the organization's security team knows them. ## Under the hood A keyboard produces a different sound depending on the key. The model studied in 2023 learns this difference from recorded keystrokes, then classifies new keystrokes [1]. The authors also discuss a series of protection methods for users [1]. The power-supply attack relies on a different phenomenon. The program changes the internal switching frequency of the power supply unit, and the shape of the sound waves produced by its capacitors and transformers [2]. The method produces tones in the 0 to 24 kHz band [2]. Its limits are given by the author: a distance of five meters and a maximum rate of 50 bits per second [2]. At this rate, small amounts of data can be transmitted, such as encryption keys or keystrokes [2]. The sources in the file describe neither the electromagnetic emissions of a screen nor the light of an LED. This page therefore does not cover them beyond this observation. ## Case files ### May 1, 2020: a computer with no speaker that talks The researcher Mordechai Guri publishes POWER-SUPPLaY. Systems isolated from the network (air-gapped) sometimes forbid audio hardware, and were then believed to be safe from covert acoustic channels [2]. His program hijacks the power supply unit to emit sounds and works on workstations, servers and connected devices with no audio hardware [2]. It is a research demonstration: the source reports no real attack. ### August 2, 2023: keystrokes recognized by a phone and by Zoom Three researchers, Joshua Harrison, Ehsan Toreini and Maryam Mehrnezhad, submit their paper, already accepted at a workshop of the IEEE European Symposium on Security and Privacy [1]. Accuracy was 95% with a nearby phone and 93% with the Zoom recording [1]. Here too, it is a laboratory result. ## Sources 1. arXiv, "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards", 2 August 2023. https://arxiv.org/abs/2308.01074 (accessed 3 November 2026) 2. arXiv, "POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers", 1 May 2020. https://arxiv.org/abs/2005.00395 (accessed 3 November 2026) 3. MITRE ATT&CK, "Audio Capture, Technique T1123 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1123/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Video Capture, Technique T1125 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1125/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1056/001/ (accessed 3 November 2026) 6. NCSC (UK), "Device security guidance", 29 June 2021. https://www.ncsc.gov.uk/collection/device-security-guidance (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.