Cyberpediaby Brain
ENDEFR

Acoustic and optical attacks (TEMPEST)

The sound of keystrokes, the noise of a power supply or an open microphone can reveal what you type or say, with nothing showing on the screen.

In 30 seconds

Where it happens
Near your keyboard, during a video call, or on a computer where malware turns on the microphone or camera.
What the attacker wants
To reconstruct what you type, including passwords, or to listen to sensitive conversations.
The reflex
Keep sensitive typing and calls away from microphones and prying eyes, and let the IT teams apply the device security guidance.
If it has already happened
Tell IT support if a microphone or camera behaves unexpectedly.

What it is

A side-channel attack spies on a device without breaking into it. Instead of forcing the computer, the attacker listens to what it gives away: the noise of the keys, the sound of a component, sometimes a microphone already open for a video call. Researchers showed in 2023 that a machine learning model recognizes a laptop's keystrokes from their sound1.

The employee sees nothing: the attack is passive, no window opens, no message appears. This page separates what the sources in the file show in the laboratory from what they describe as a real intrusion technique, and gives simple steps to limit exposure.

Straight answers

Can someone guess what I type just by listening to me?

Researchers have done it in the laboratory. They recorded a laptop's keystrokes with the microphone of a nearby phone, then trained a classifier: it recognizes the keys with 95% accuracy1. They note that this result is the highest obtained without a language model1.

Is a video call enough?

In the same study, keystrokes recorded through the Zoom video conferencing software were recognized with 93% accuracy, a record for this recording method according to the authors1. The authors write that their results prove the practicality of these attacks with off-the-shelf equipment and algorithms1.

Is a computer without a speaker safe?

Not necessarily. A researcher described in 2020 a malware program that makes the computer's power supply play sounds, with no sound card or speaker2. Data can be modulated in these sounds and picked up by a nearby receiver, such as a smartphone2.

Is this a common risk for an employee?

The sources in the file describe research demonstrations, not incidents involving employees. The intrusion techniques they document are of a different kind: software installed on the computer that records the microphone, the camera or the keystrokes345. These are the ones that concern the employee first.

Who should worry about this first?

Organizations. The UK's NCSC publishes guidance on choosing, configuring and using devices safely, aimed mainly at professional users and at those responsible for large fleets of IT equipment6.

1Inside the attacker's head1 min

The attacker has two routes. The first is at physical range: he places a microphone near the target, or relies on a call that is already open, and has the recording analyzed. The 2023 study relies on a phone placed next to a laptop and on the sound transmitted by Zoom1. It requires only off-the-shelf equipment and known algorithms1.

The second route goes through malware. MITRE describes adversaries who use a computer's microphones and cameras, or voice and video call applications, to listen to sensitive conversations3. The audio files can be written to disk and exfiltrated later3. For video, the technique is similar: built-in cameras or webcams, with images taken at chosen intervals4.

The most direct goal is the password. MITRE notes that keystroke capture is used to intercept credentials at the moment the user enters them5.

2What you see on screen1 min

Nothing. In the acoustic attack, the computer is not touched: everything happens in the air, between your keyboard and a microphone. In the power-supply attack, the malicious code runs in a simple user process, with no special privileges or access to the hardware2.

For audio or video capture, the program goes through an interface (API) provided by the system or by an application34. The sources give no sign visible on screen. A clue can come from elsewhere: a microphone or camera that turns on when you have started no call justifies a report to support.

The useful steps are simple. Keep passwords and sensitive data out of range of a microphone, especially during a call, and mute the microphone when you type. Take sensitive calls in a discreet place. Angle the screen so that it cannot be seen from outside. Apply the configuration rules of your IT teams: the NCSC provides guidance for administrators and for users alike6. A computer cut off from the network or without a speaker is not safe for all that: the 2020 study shows this for the acoustic route2. Government agencies and companies that handle highly sensitive information have their own protection standards, which the sources in the file do not describe: the organization's security team knows them.

3Under the hoodIT teams1 min

A keyboard produces a different sound depending on the key. The model studied in 2023 learns this difference from recorded keystrokes, then classifies new keystrokes1. The authors also discuss a series of protection methods for users1.

The power-supply attack relies on a different phenomenon. The program changes the internal switching frequency of the power supply unit, and the shape of the sound waves produced by its capacitors and transformers2. The method produces tones in the 0 to 24 kHz band2. Its limits are given by the author: a distance of five meters and a maximum rate of 50 bits per second2. At this rate, small amounts of data can be transmitted, such as encryption keys or keystrokes2.

The sources in the file describe neither the electromagnetic emissions of a screen nor the light of an LED. This page therefore does not cover them beyond this observation.

4Case filesReal cases1 min

May 1, 2020: a computer with no speaker that talks

The researcher Mordechai Guri publishes POWER-SUPPLaY. Systems isolated from the network (air-gapped) sometimes forbid audio hardware, and were then believed to be safe from covert acoustic channels2. His program hijacks the power supply unit to emit sounds and works on workstations, servers and connected devices with no audio hardware2. It is a research demonstration: the source reports no real attack.

August 2, 2023: keystrokes recognized by a phone and by Zoom

Three researchers, Joshua Harrison, Ehsan Toreini and Maryam Mehrnezhad, submit their paper, already accepted at a workshop of the IEEE European Symposium on Security and Privacy1. Accuracy was 95% with a nearby phone and 93% with the Zoom recording1. Here too, it is a laboratory result.

Fact sheet

Identifier
CP-095
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-073
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. arXiv, “A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards”, 2 August 2023. https://arxiv.org/abs/2308.01074 (accessed 3 November 2026)
  2. arXiv, “POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers”, 1 May 2020. https://arxiv.org/abs/2005.00395 (accessed 3 November 2026)
  3. MITRE ATT&CK, “Audio Capture, Technique T1123 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1123/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Video Capture, Technique T1125 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1125/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1056/001/ (accessed 3 November 2026)
  6. NCSC (UK), “Device security guidance”, 29 June 2021. https://www.ncsc.gov.uk/collection/device-security-guidance (accessed 3 November 2026)

Cite this article

Brain, “Acoustic and optical attacks (TEMPEST)”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/

BibTeX 
@misc{brain_cp095_en_2026,
  author = {Brain},
  title = {Acoustic and optical attacks (TEMPEST)},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/acoustic-optical-attacks-tempest/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence