Hardware Threat Minimization

From Whonix


Ambox warning pn.svg.png Advanced adversaries already have specialized implant plug-ins which can take over the computer's microphone [archive] and record nearby conversations. [1] [2]

Eavesdropping Risk[edit]

It is recommended to check whether the computer or notebook has a microphone. Microphones are often built-in and go unnoticed. In most cases it is advisable to disable the microphone for security reasons. If Whonix-Workstation ™ (anon-whonix) is ever compromised by malware, an adversary could eavesdrop through the microphone. [3] Similarly, keyboard acoustic side channel attacks can use the audio leakage from keyboard typing to infer the words up to a certain degree of accuracy. [4] [5] This also applies to touch screen devices like smartphones and tablets. [6]

The attack paper SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit [archive] does not apply to VMs. [7] While it might be possible to retask virtual sound devices with software too, the malware still cannot access the soundcard settings of the host unless there is a VM escape; QEMU developers have also concluded that no risk is posed to the host. It should be noted that virtual soundcards also have optional, half-duplex modes that make audio input impossible. [8] [9] [10] [11]


  1. An attacker needs to physically tamper with the targeted equipment. [13]
  2. Sounds near the hard drive must be rather loud:

Note that this attack does not apply to VMs where disk devices are emulated. While the SSD alternative avoids this threat, it has the drawback of uncertainty when encrypted volume headers are deleted or encryption passphrases are changed.

Voice Recognition[edit]

It is safe to assume that everyone has had an unencrypted phone call during their lifetime and that one of them has been recorded. Voiceprints allow a person to be identified from the specific characteristics (acoustics) of their voice and it is a useful biometric marker. [14] This means personal and unique voiceprints can be used to link non-anonymous and "anonymous" voice samples; a process called voice recognition and documented on the VoIP wiki page in the introduction chapter. [15]

Disabling or Removing Microphones[edit]

By default, microphones that are connected to the host are made available to virtual machines like Whonix-Workstation ™ (except for Whonix ™ KVM on Buster hosts and Qubes-Whonix ™, see further below).



  • Windows: the drivers can be disabled from the Device Manager.


Select Use of Microphones[edit]

Multiple Whonix-Workstation ™s should be used for:

  • Making Internet calls.
  • Conducting Voice over IP (VoIP).
  • Any other microphone use inside Whonix-Workstation ™ (anon-whonix).

In this way, the microphone is used in select Whonix-Workstation ™s and not all. The microphone should be unplugged after use.


Expand for further information:




VirtualBox has access to the host's microphone by default. Access can be disabled by either muting it on the host or alternatively [16] it is possible to enable/disable VM guest access to the host's microphone on the command line. [17]

When the VM is stopped, run.

VBoxManage modifyvm <uuid|vmname> audioin off

Or when the VM is up and running, use.

VBoxManage controlvm <uuid|vmname> audioin off


From Qubes R4, the desktop panel icon ("Q") is used to attach or detach microphones to select VMs: [18] [19]

Left-click "Q"Assign the microphone to select VM



To mitigate this threat, apply the following measures on the host:

  • Always connect headphones. [21]
  • Physically remove speakers (very difficult). [22]
  • Physically remove the beeper (very difficult). [22]
  • If possible, disable the beeper in BIOS (moderately difficult).


Ambox warning pn.svg.png Webcams pose a serious spying [archive] risk [archive]!

Webcams on infected machines can be used to take snapshots, record video or eavesdrop using the built-in microphone. Recent research [archive] reveals that even remote screen views can be accurately determined via webcams, due to "content-dependent acoustic leakage from LCD screens." [23]

Always check if the computer or notebook has a webcam; one might be built-in, but have gone unnoticed. Check the computer's datasheet and operating system hardware manager to be sure. It is recommended that (external) webcams are disabled or removed, unless there are immediate plans to use it inside Whonix-Workstation ™ (anon-whonix). Once a webcam session has finished, it should be disabled and preferably unplugged straight away.




Wireless Input Devices[edit]



  2. https://www.wired.com/2014/03/webcams-mics/ [archive]
  3. One attack vector is the use of spam emails which contain malware [archive].
  4. https://fc16.ifca.ai/preproceedings/21_Anand.pdf [archive]
  6. https://www.schneier.com/blog/archives/2019/04/recovering_smar.html [archive]
  7. The abstract notes:


  8. https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg04754.html2 [archive]
  9. https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg04899.html2 [archive]
  10. https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg04906.html2 [archive]
  11. https://lists.nongnu.org/archive/html/qemu-devel/2016-11/msg04904.html2 [archive]
  12. https://www.extremetech.com/electronics/287324-researchers-turn-hard-drives-into-covert-listening-devices [archive]
  13. One possible method is hardware interception during shipping.
  14. https://en.wikipedia.org/wiki/Speaker_recognition#Technology [archive]
  15. Writing styles are also personal and unique. Individuals can be identified with a similar method called stylometry [archive], which is documented on the Surfing Posting Blogging wiki page.
  16. From VirtualBox 5.2
  17. https://www.virtualbox.org/ticket/12026 [archive]
  18. https://www.linuxjournal.com/content/whats-new-qubes-4 [archive]
  19. Functionality is gradually being shifted from Qube Manager to standalone tools.
  20. https://www.schneier.com/blog/archives/2015/11/ads_surreptitio.html [archive]
  21. It is unclear if this measure can be circumvented by malicious software.
  22. 22.0 22.1 Many users are incapable of opening their notebooks, but desktop computer hardware is easily accessed.
  24. https://www.schneier.com/blog/archives/2016/03/security_vulner_6.html [archive]
  25. https://www.schneier.com/blog/archives/2016/08/security_vulner_7.html [archive]


https [archive] | (forcing) onion [archive]


Whonix donate bitcoin.png

Share: Twitter | Facebook






Monero donate whonix.png