Mic-E-Mouse attack: why ultra-high DPI mice are merely a security hazard

[lightwo]

Word got out that high-DPI (about >=20,000 DPI) mice are so sensitive that speech can be reconstructed from the recorded vibrations, enabling covert eavesdropping without any microphones connected.

https://hackread.com/mic-e-mouse-attack-computer-mice-conversations/

https://sites.google.com/view/mic-e-mouse

https://arxiv.org/pdf/2509.13581

Granted, if you checked out their demonstration video, it looks like they used a cardboard box, which is definitely a surface more prone to vibrations than an average desk, but their study claims that thin (<=3 cm thick) desks are within margin. (Mousepad?)

Well then, if the ultra high-DPI mice sounded a bit ridiculous before, they absolutely do now. It doesn't seem necessary to have a mouse whose only measurable advantage over lower-DPI mice is to record minuscule vibrations. Bigger number eventually gets big enough that it doesn't get better...

What do you think?

 

[a_username_that_is_cool]

Why would people buy these mice

 

[lightwo]

I ran across many comments which brought up that mousepads weren't observed in the study at all. While I'm not too convinced that a mousepad would make a big difference, I can think of a case which could drastically worsen the issue: glass mousepads.

I'm not saying that glass mousepads are bad, I never even tried one, but something tells me they vibrate a whole lot more than the desk would!

 

[Kioku]

Why would people buy these mice

They don’t buy high DPI mice to max out their DPI. These kinds of mice usually come with sensors that are better for gaming than standard office mice.

 

[SylverReZ]

Why would people buy these mice

I was about to say. Nobody needs a mouse with adjustable DPI that high, unless you're going to be playing FPS games like Counter Strike Source or Overwatch, then keep it to 2200 or below DPI whichever suits; otherwise, keep to a standard mouse for office work.

 

[yankii]

Another day of thanking God for making the Switch 2 unhackable.

 

[IsabellaWhite]

what is the purpose of such high DPI mouse?

 

[lightwo]

Another day of thanking God for making the Switch 2 unhackable.

How's that relevant? Joy-Con 2 isn't marketed to have a high-fidelity optical sensor, so while the specs for it are unavailable, it is safe to assume they're nowhere near the 20,000 DPI mark.

Unless Switch 2 mouse gaming becomes serious enough that OEMs like Logitech create unnecessarily high-DPI mice for Switch 2 (if its built-in wireless chip would even allow for it, given that external dongles feel unprofessional for console gear), Switch 2 has no relevance here.

And who in their right mind would go through the hassle of finding a covert, remote exploit for Switch 2 just to enable surveillance? That's not even a realistic combination, threat actors would surely find more value in stealing accounts and/or payment information.

 

[icegod]

This reminds me how people said we could reconstruct sounds from ancient pottery pots, and how it also turned out to be complete bs.

Now honestly, even if this would be possible, for majority of us gamers, who would be interested in what we're saying in the privacy of our home? Who would go through all the trouble making a program, planting it into our pc's and such.

 

[Kioku]

This reminds me how people said we could reconstruct sounds from ancient pottery pots, and how it also turned out to be complete bs.

Now honestly, even if this would be possible, for majority of us gamers, who would be interested in what we're saying in the privacy of our home? Who would go through all the trouble making a program, planting it into our pc's and such.

Not sure if you’re trolling, but I’ll entertain this for a second. You really think that hackers wouldn’t do this? They’ve done more for less.

 

[icegod]

Not sure if you’re trolling, but I’ll entertain this for a second. You really think that hackers wouldn’t do this? They’ve done more for less.

Sure, but even as a hacker, it isn't easy to get the malware on someone's pc. In most cases, you have to hope you can trick someone to install the malware somehow. Most people having these kinds of mice, do have basic internet knowledge, so chances are pretty low of that happening.

And still the why keeps standing. Even if we're interesting enough to be tapped, wouldn't it make more sense hacking a laptop's or phones microphone? It would be a lot easier to do, with better quality.

It's not trolling, it's kicking in an open door. It's a true non-issue.

 

[lightwo]

Most people having these kinds of mice, do have basic internet knowledge, so chances are pretty low of that happening.

I don't think there's a clear-cut distinction. A lot of gamers lack on basic computer knowledge. Anyway...

And yet streamers (who tend to have all the clout) continue to be targeted and sometimes fall for it. Attacks of this kind are spread en masse as there is always a chance someone screws up, and most malware campaigns I recall indeed carried numerous victims.

Think of it like this. If you're a streamer, you're going to have people suggesting you games (reflecting on the BlockBlaster malware incident). If you're very desperate for free games/in-game items, sometimes common sense ceases to work. There are many cases with people "too big to fail" as well as knowledgeable netizens who get caught with their pants down.

Also, before you call me out for bringing up streamers: yes, they do tend to have microphones plugged in at all times, but attackers could be interested in spying on their off-camera activity, for instance.

 

[RAHelllord]

A couple things of note here, the 20,000 dpi was hallucinated from the writer of the article, the actual metric that's important for the sound reconstruction from the recorded movement patterns is the 8,000 Hz polling rate.
I assume the DPI might be important to register finer movements of the mouse / sensor, but in order to reconstruct any sort of speech the sample rate has to be fast enough, and that is around 8khz for human speech.

Human speech generally falls around 2khz to 4khz for the important noises, specifically consonants, and recording double the frequency allows the most faithful reconstruction of those sine waves.

Also while this is an interesting and novel approach to spying on users, most people have their microphones plugged in all the time, which have much higher sensitivity and resolution all around, and the OS safeguards are usually much more reliable to circumvent than trying to record mice at 8khz and hope you can reconstruct speech from the captured whitenoise.

 

[The Real Jdbye]

This reminds me how people said we could reconstruct sounds from ancient pottery pots, and how it also turned out to be complete bs.

Now honestly, even if this would be possible, for majority of us gamers, who would be interested in what we're saying in the privacy of our home? Who would go through all the trouble making a program, planting it into our pc's and such.

They wouldn't have to. Websites can track mouse movements so all it takes is visiting a website with malicious javascript planted in it, and every website these days tracks their users so it isn't far fetched at all that one of the two dozen different trackers, ad domains, analytics or what not that a website uses (some of which are already malicious) could have this in it and use it to track users even more effectively than they already do.
(Not sure if JS can poll mouse movements with high enough granularity though)

If you have malware on your PC then you are screwed anyways. They can already access your microphone so there would be no point in this. This would not be useful for malware attacks outside of specific targeted attacks where an attacker wants to eavesdrop on a particular company or person and a microphone is not available. It would mainly be useful for tracking.

I ran across many comments which brought up that mousepads weren't observed in the study at all. While I'm not too convinced that a mousepad would make a big difference, I can think of a case which could drastically worsen the issue: glass mousepads.

I'm not saying that glass mousepads are bad, I never even tried one, but something tells me they vibrate a whole lot more than the desk would!

I do think mousepads make a big difference because they are usually made out of rubber. They are essentially anti vibration pads.

 

[bonkmaykr]

800 pixels per inch is enough for most people. Mine is 1600 for slightly better microadjustments to my aim in shooters since I play at a high sensitivity. Can't see any reason it needs to be over a dozen times that.

(Not sure if JS can poll mouse movements with high enough granularity though)

Yeah you would need an API providing raw input from the hardware directly because unless your monitor has a stupidly high resolution too and you use a pointer sensitivity to match you're not going to get anything out of the logical movement of the pointer.

This does exist but I don't know if ECMAscript specification promises it will have precise accuracy.

 

[yankii]

Can't see any reason

Gamers are people who pay extra for "gaming" chairs/goods; "reasons" are optional at best.

 

[bonkmaykr]

Gamers are people who pay extra for "gaming" chairs/goods; "reasons" are optional at best.

Oh trust me I know... I still have nightmares about the Counterstrike community. Literally nobody who is enthusiastic about buying their own "esports" equipment has a single clue how a video game works practically. Had a LOT of people who were convinced that my software engineering creds were of less significance than their unimpressive ranked placement in deciding who knows what they're talking about.

Case in point, the comments on these two...
https://steamcommunity.com/sharedfiles/filedetails/?id=3338751531