Abstract
Music is an expression of our identity, showing a significant correlationwith other personal traits, beliefs, and habits. If accessed by a maliciousentity, an individual's music listening habits could be used to make criticalinferences about the user. In this paper, we showcase an attack in which thevibrations propagated through a user's phone while playing music via itsspeakers can be used to detect and classify songs. Our attack shows that known songs can be detected with an accuracy of justunder 80%, while a corpus of 100 songs can be classified with an accuracygreater than 80%. We investigate such questions under a wide variety ofexperimental scenarios involving three surfaces and five phone speaker volumes.Although users can mitigate some of the risk by using a phone cover to dampenthe vibrations, we show that a sophisticated attacker could adapt the attack tostill classify songs with a decent accuracy. This paper demonstrates a new way in which motion sensor data can beleveraged to intrude on user music preferences without their expresspermission. Whether this information is leveraged for financial gain orpolitical purposes, our research makes a case for why more rigorous methods ofprotecting user data should be utilized by companies, and if necessary,individuals.