Pierluigi Paganini
July 10, 2016
A group of researchers from the University of California, Berkeley, and Georgetown University has devised a method for hacking mobile devices by using hidden voice commands embedded in YouTube videos.
In order to hack the mobile device, the victim only has to view a specific crafted YouTube video containing hidden commands. The victim can view the video from multiple nearby sources, including a laptop, a computer, a smart TV, a smartphone or a tablet.
The hidden commands are received by Google Now or Siri personal assistant that filter them from noise and sounds and execute them.
The researchers published the details of the technique for hacking mobile devices in a paper titled “Hidden Voice Commands.”
“We explore in this paper how they can be attacked with hidden voice commands that are unintelligible to human listeners but which are interpreted as commands by devices. We evaluate these attacks under two different threat models.” states the introduction of the project. “In the black-box model, an attacker uses the speech recognition system as an opaque oracle. We show that the adversary can produce difficult to understand commands that are effective against existing systems in the black-box model. Under the white-box model, the attacker has full knowledge of the internals of the speech recognition system and uses it to create attack commands that we demonstrate through user testing are not understandable by humans. We then evaluate several defenses, including notifying the user when a voice command is accepted; a verbal challenge-response protocol; and a machine learning approach that can detect our attacks with 99.8% accuracy.”
A similar attack was already devised by the Intelligence French agency ANSSI in October 2015 when a team of experts discovered that a hacker can completely control mobile devices from as far as 16 feet away.
The hackers can remotely hack a smartphone by silently transmitting radio commands to the voice control systems implemented by both Apple and Google, the Apple’s Siri and Android’s Google Now.
The hack was working only if the targeted device has the headphones plugged into its jack, under these conditions the attack works without even speaking a word.
“The possibility of inducing parasitic signals on the audio front-end of voice-command-capable devices could raise critical security impacts,” the two French researchers, José Lopes Esteves and Chaouki Kasmi, explained in a paper published by the IEEE.
The hack utilized:
Returning to the present, the researchers have published a video PoC of the black box attack being carried out in presence of background noise with the target phone kept at a distance on 10.1 ft away from the speakers used to play the attack audio.
The attackers can hide several types of commands in the videos, including instructions to download and install a malicious code from a certain host.
Researchers also suggest a series of countermeasures, including a notification every time a voice command is received by the mobile or the adoption of a verbal challenge-response system.
For further technical details give a look to the project’s official website.
[adrotate banner=”9″]
(Security Affairs – hacking mobile phone, Hidden Voice Commands)
