Alexa, Siri, Cortana vulnerable to "silent hacking"

Inaudible voice commands could be used to take over virtual assistants and smart speakers, researchers find

Smart speakers from some of the industry's leading companies have been found to be vulnerable to an exploit that allows hackers to take control of a device by issuing silent commands.

Researchers at Zhejian University in China recently discovered a technique known as "DolphinAttack", which involves modulating the sounds of an individual's voice so that they are inaudible to human ears, but are still capable of issuing commands to a speaker.

The microphones built into some of the most popular home speakers, including the Amazon Echo and Google Home, and common consumer devices like tablets and laptops, are able to pick up the inaudible commands and perform tasks seemingly at random to their user.

Specifically, the attack is able to send commands using ultrasonic frequencies in a range above 20,000hz, something that a human voice can't possibly recreate or listen out for.

In lab tests at the university, researchers were able to demonstrate the trick with smart assistants developed by Google, Amazon, Apple, Microsoft, and Huawei. The tests allowed researchers to not only turn on each device, but activate functions such as airplane mode, opening websites and more importantly, interact with any smart home device linked to the speaker.

Smart devices are becoming increasingly popular additions to homes, however the vulnerability raises concerns that appliances such as smart locks or connected thermostats could be silently controlled by a hacker.

Unfortunately, the process of modulating a voice and playing back audio at high frequencies can be performed using various devices that cost as little as $3, according to the researchers. However, in order for the process to work, a hacker needs to be within six feet of the targeted speaker and to go entirely undetected, the speaker would need to be unlocked first, otherwise a tone would alert the user to a command.

The researchers recommend device manufacturers and developers should ensure that commands issued at frequencies that are impossible for humans to communicate in are ignored.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Citrix mulling potential sale after tumultuous 2021
mergers and acquisitions

Citrix mulling potential sale after tumultuous 2021

15 Sep 2021
Zoom: From pandemic upstart to hybrid work giant
video conferencing

Zoom: From pandemic upstart to hybrid work giant

14 Sep 2021