  Mobile devices often distribute measurements from physical sensors to
multiple applications using software multiplexing. On Android devices, the
highest requested sampling frequency is returned to all applications, even if
others request measurements at lower frequencies. In this paper, we
comprehensively demonstrate that this design choice exposes practically
exploitable side-channels using frequency-key shifting. By carefully modulating
sensor sampling frequencies in software, we show how unprivileged malicious
applications can construct reliable spectral covert channels that bypass
existing security mechanisms. Additionally, we present a novel variant that
allows an unprivileged malicious application to profile other active,
sensor-enabled applications at a coarse-grained level. Both methods do not
impose any special assumptions beyond accessing standard mobile services
available to developers. As such, our work reports side-channel vulnerabilities
that exploit subtle yet insecure design choices in Android sensor stacks.
