The Science of Inaudible Voice Hacking

Summary

The video script explores the growing vulnerabilities of voice-controlled devices as they become ubiquitous in our lives. It discusses novel attack methods, such as psychoacoustic hiding, ultrasonic 'dolphin' attacks, and laser-based hacks, which exploit the weaknesses in smart devices like Alexa, Siri, and Google Assistant. These attacks allow hackers to control devices, access sensitive data, and manipulate systems, all without the user’s knowledge. The script also touches on the potential for cross-device tracking and the importance of privacy in an increasingly connected world.

Takeaways

• 🔊 Voice assistants are becoming more widespread, with over 4.2 billion devices in 2021, surpassing the global population.
• 🛡️ Convenience of voice assistants comes with significant security vulnerabilities that can be easily exploited.
• 🎙️ Researchers have demonstrated attacks using psychoacoustic hiding, where hidden commands are embedded in everyday audio.
• 📱 In a method known as dolphin attack, inaudible ultrasonic commands can be used to control devices without user knowledge.
• 🎶 Psychoacoustic hiding and dolphin attacks exploit the limited human hearing range to insert commands undetected.
• 💻 Voice assistants can be hacked to open malicious websites, control cars, unlock doors, or initiate phone calls.
• 📡 Researchers have extended the attack range of ultrasonic commands to 25 feet, even bypassing voice fingerprinting protections.
• 🖱️ The surfing attack leverages solid materials to transmit inaudible commands over greater distances without line of sight.
• 🔦 Researchers also discovered laser attacks, where focused light can move a microphone diaphragm, allowing voice control over vast distances.
• 🔐 Current defenses include disabling microphones or muting voice assistants, but this undermines their functionality.

Q & A

What are some vulnerabilities introduced by the increasing use of voice assistants?

Voice assistants introduce new vulnerabilities such as hijacking through psychoacoustic hiding, dolphin attacks, and laser-based control. These attacks can exploit always-on microphones to send commands without the user's knowledge, potentially leading to privacy breaches, device manipulation, and security risks.

What is 'psychoacoustic hiding' and how does it pose a threat?

Psychoacoustic hiding exploits the limits of human hearing by embedding malicious voice commands into audio that sounds normal to people. Devices like voice assistants can interpret these hidden commands, allowing attackers to control them without the user noticing.

How do ultrasonic attacks like 'dolphin attack' work?

Dolphin attacks involve sending ultrasonic frequencies, inaudible to humans, that voice assistants can still detect. Attackers use these frequencies to trigger commands, like opening websites, making phone calls, or manipulating settings, without the user being aware.

What are the dangers of laser-based attacks on voice assistants?

Laser-based attacks exploit the diaphragm of a voice assistant's microphone by moving it with light, mimicking voice commands. This allows attackers to control devices from long distances, potentially opening garage doors, unlocking smart locks, or even controlling cars.

What measures can users take to protect against voice assistant hijacking?

Users can disable the always-on listening feature, mute microphones when not in use, and require voice commands only when the phone is unlocked. However, these solutions may reduce the functionality of the device. Physically hiding devices from line of sight can also help mitigate certain attacks like laser-based hijacking.

How can voice assistants be hacked using 'surfing attack'?

Surfing attacks use solid materials, like tabletops, to carry sound waves and transmit commands to voice assistants. This allows for longer-range attacks and even out-of-sight control of devices, making it a particularly hard-to-detect vulnerability.

What role does ultrasonic cross-device tracking play in security risks?

Ultrasonic cross-device tracking is used in advertising to track devices through inaudible signals. These signals can extract information even when a device is not connected to the internet, presenting a privacy risk by continuously monitoring user behavior across multiple devices.

What was the outcome of researchers beaming laser commands to voice assistants?

Researchers successfully used lasers to control voice assistants from up to 350 feet away. They were able to open smart locks, make online purchases, and unlock cars, showing that light can travel much farther than ultrasonic sound for such attacks.

Why is the always-on listening feature of voice assistants a major vulnerability?

The always-on feature allows voice assistants to be constantly listening for commands, making them susceptible to a range of attacks like psychoacoustic hiding and ultrasonic hacking. This feature enables attackers to send malicious commands without user interaction.

What alternative approaches could improve the security of voice assistants?

Open-source speech recognition systems, like Mozilla DeepSpeech, offer more control over privacy. Users could also consider disabling internet access for voice assistants or implementing stronger security measures, like requiring physical interaction or more robust encryption.