InfoSecBulletin Cybersecurity for mankind
Researchers at NDSS 2026 show a hidden listening attack that turns normal FTTH telecom fiber cables into quiet spying tools. These tools cannot be seen by RF scanners and are safe from ultrasonic jammers.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Security experts from The Hong Kong Polytechnic University, The Chinese University of Hong Kong, and the Technological and Higher Education Institute of Hong Kong have revealed a serious side-channel attack. This attack can make regular fiber optic internet cables act like hidden microphones. They can pick up private talks.
The research, titled “Hiding an Ear in Plain Sight: On the Practicality and Implications of Acoustic Eavesdropping with Telecom Fiber Optic Cables,” was presented at the Network and Distributed System Security (NDSS) Symposium 2026 held in San Diego, California.
Fiber Optic Cables Turned Into Microphones
Fiber optic cables are seen as safe ways to communicate because they are not affected by radio waves and other electronic signals. However, research reveals that this idea is wrong. It shows that optical fibers can be affected by sound vibrations.
When sound waves hit the fiber, they change its tiny structure. These changes cause laser light moving through the fiber to shift in phase.
By watching these changes with a Distributed Acoustic Sensing (DAS) system linked to one end of the cable, an attacker can recreate the original sound wave from the other end, even over distances greater than 50 meters.
Because standard fiber alone is not sensitive enough to capture airborne speech, the researchers engineered a custom “Sensory Receptor” — a hollow PET (polyethylene terephthalate) cylinder, 65mm in diameter, with 15 meters of optical fiber tightly wound around it.
The cylinder increases sound pressure changes and turns them into stretching along the fiber, greatly improving sound pickup ability.
This device can look like a regular optical fiber box. It is the same type often put in homes and offices when installing FTTH. This makes it almost impossible to tell apart from real networking tools.
The attack needs someone to be physically present at both the victim’s place (ONU) and the Optical Distribution Network (ODN). This is a real threat.
FTTH setups often need ISP workers, subcontractors, or outside service providers to touch fiber points when installing, upgrading, or fixing issues. In these times, a bad insider or an attacker pretending to be one could secretly place the sensory receptor.
The research team’s lab and real-world office experiments produced striking results:
Speech recovery at 2 meters achieved a Word Error Rate (WER) below 20%, meaning over 80% of spoken content was successfully transcribed using AI speech recognition models including OpenAI Whisper and NVIDIA Parakeet.
Indoor localization of a speaker’s position was accurate to an average of 77 centimeters within a room.
Sound event detection (identifying activities like typing, coughing, or alarms) reached 83% accuracy after fine-tuning deep learning models on recovered audio.
In a real office scenario spanning two rooms separated by 50+ meters of fiber cable, the best placement (fiber box under a desk) yielded a mean WER of just 9% — a near-perfect transcript.
Fiber optic sensors work without electricity and do not send out any radio signals. This makes them completely undetectable by regular TSCM inspections or RF bug detectors.
Researchers tested commercial ultrasonic jammers, which are often used to block hidden microphones. They found that the optical-fiber-based system still recognized speech well, even when the jammer was only 10 centimeters away. Regular microphones didn’t work at all.
Mitigations
The researchers recommend several countermeasures to reduce exposure:
Install polished fiber connectors to introduce Fresnel reflections that create dead zones in DAS detection.
Deploy optical isolators on transmission channels to prevent Rayleigh backscatter from returning to potential attackers.
Minimize excess fiber slack inside rooms and prevent cables from looping around or contacting resonant surfaces like desks or walls.
Add sound-proofing materials to walls and ceilings where fiber cables run.
The results are very important for company boardrooms, government buildings, and diplomatic settings. The attack is quiet, cannot be easily blocked, and lets enemies gather secret information without being detected.
