Alexa, Siri, Cortana vulnerable to "silent hacking"

Inaudible voice commands could be used to take over virtual assistants and smart speakers, researchers find

Smart speakers from some of the industry's leading companies have been found to be vulnerable to an exploit that allows hackers to take control of a device by issuing silent commands.

Researchers at Zhejian University in China recently discovered a technique known as "DolphinAttack", which involves modulating the sounds of an individual's voice so that they are inaudible to human ears, but are still capable of issuing commands to a speaker.

The microphones built into some of the most popular home speakers, including the Amazon Echo and Google Home, and common consumer devices like tablets and laptops, are able to pick up the inaudible commands and perform tasks seemingly at random to their user.

Specifically, the attack is able to send commands using ultrasonic frequencies in a range above 20,000hz, something that a human voice can't possibly recreate or listen out for.

In lab tests at the university, researchers were able to demonstrate the trick with smart assistants developed by Google, Amazon, Apple, Microsoft, and Huawei. The tests allowed researchers to not only turn on each device, but activate functions such as airplane mode, opening websites and more importantly, interact with any smart home device linked to the speaker.

Smart devices are becoming increasingly popular additions to homes, however the vulnerability raises concerns that appliances such as smart locks or connected thermostats could be silently controlled by a hacker.

Unfortunately, the process of modulating a voice and playing back audio at high frequencies can be performed using various devices that cost as little as $3, according to the researchers. However, in order for the process to work, a hacker needs to be within six feet of the targeted speaker and to go entirely undetected, the speaker would need to be unlocked first, otherwise a tone would alert the user to a command.

The researchers recommend device manufacturers and developers should ensure that commands issued at frequencies that are impossible for humans to communicate in are ignored.

Featured Resources

Become a digital service provider

How to transform your business from network core to edge

Download now

Optimal business results with the cloud

Evaluating the best approaches to hybrid cloud adoption

Download now

Virtualisation that enables choices, not compromises

Harness the virtualisation technology that's right for your hybrid infrastructure

Download now

Email security threat report 2020

Four key trends from spear fishing to credentials theft

Download now

Recommended

How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
Weekly threat roundup: Microsoft Defender, Adobe, Mimecast
vulnerability

Weekly threat roundup: Microsoft Defender, Adobe, Mimecast

14 Jan 2021
Mimecast admits hackers accessed users’ Microsoft accounts
Security

Mimecast admits hackers accessed users’ Microsoft accounts

13 Jan 2021
What is public key infrastructure (PKI)?
Security

What is public key infrastructure (PKI)?

12 Jan 2021

Most Popular

What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021
150,000 arrest records accidentally deleted from police database
data management

150,000 arrest records accidentally deleted from police database

15 Jan 2021
Can Pat Gelsinger get Intel back on track?
chief executive officer (CEO)

Can Pat Gelsinger get Intel back on track?

13 Jan 2021