The Backend of Inaudible Voice Hacking

Do you like being a human? Voice assistants are convenient, and your pals are disappointed because they do not exist; oh my, this escalated swiftly intuitively. Alexa Will you be my friend? Yes, and I was human.

Special Thanks to https://www.youtube.com/c/TheHatedOne/featured

With over 4.2 billion devices in use by 2021, there will soon be more voice help than humans. Speech recognition systems are a natural development in handling our input/output constraints; we moved from utilizing ten fingers to two thumbs, and before microchipping plans are ultimately established, voice commands are the obvious middle stage. but as we pursue convenience at all costs we’re also introducing new vulnerabilities into our lives with increasingly more damaging impact your virtual assistant can be hijacked more easily than anyone could imagine anyone except for scientists proving one paper at a time how trivial it is to command your digital Butler to visit the malicious website open your garage door or manipulate your car I love it when science is used to study privacy and security issues how can I help you or maybe how can I steal your private information so I’m very happy to show you several research papers proving multiple novel methods of attacking our smart devices I hope you’re ready because this will get heavy very quickly so let’s begin the Wallop puzzle would cost 5.42 billion dollars over five years did you hear that let’s try another one if you didn’t notice anything strange that’s on purpose these audio files were produced by German scientists at the rural University they are a proof of concept of a novel attack on voice control devices known as psychoacoustic hiding while we only hear a random speech specific typically the union said it was proposing to purchase your device also hears an actual voice command if you pay close attention you will notice it but if you just go about your day commute or do anything with your brain and autopilot you’d miss it let’s hear it from the birds again well you’re only supposed to hear the chirping the machine in your pocket or on your desk also hears this foreign together it’s almost indistinguishable what this presents is a novel attack Vector on voice-enabled devices using the method known as psychoacoustic hiding psycho Acoustics is a benign field that studies what human hearing can and cannot process based on a range of frequencies amplitudes and Signal Dynamics psychoacoustics is used in mp3 music compression to generate audio files that remove parts of the audio inaudible to human ears thus making the file smaller using the same algorithm the German scientist turned psychoacoustics into an attack Vector to modify audio signals and hide transcription inside any audio file with a near 100 success rate voice assistants are becoming a ubiquitous part of our daily lives they sit inside our phones they wait for us in our homes they navigate us on our roads the increasingly control more and more aspects of our digital and physical presence we trust them with our contacts messages emails or searches we use them as convenient reminders task managers and even put them in charge of babysitting and locking our doors but all that convenience comes with the price voice assistants are incredibly vulnerable researchers from the Georgetown University developed a new method of hacking called many of the elevator attack in this scenario a loudspeaker in an elevator would play sounds unrecognizable to human ears during an elevator ride the victim’s advice would interpret the sounds as voice commands the attackers could command the victim’s Voice Assistant to open a malicious website make a phone call send a text message or turn on an airplane mode all via remote sounds the researchers also built on the premise of voice quoting this isn’t attack where certain words would trigger the same response from a voice assistant as proper commands for example cocaine noodles would be interpreted as a order to activate via voice OK We wouldn’t be living in a Black Mirror future if Google allowed this assault to expand to hundreds or even millions of devices by embedding malicious orders in video or audio adverts on radio, TV, or the internet. While psychoacoustic concealment is a successful attack, it would be even better if malevolent noises were entirely inaudible to human ears. Because our hearing is quite poor, our hearing frequencies span from roughly 31 Hertz to about 20 kilohertz. but the older you are the worse your hearing gets some humans especially children can hear sounds above the 20 kilohertz threshold but most adults struggle to register anything above 15 or 16 kilohertz if you wanted to reignite your existential crisis just play the mosquito ringtone some years ago this trend went viral where the children would communicate in higher frequencies that adults couldn’t hear most of my audience is in the key demo so most of you will probably tap out sooner than you’d expect all frequency is about the 20 kilohertz range or a cold ultrasonic or ultrasound and while you can’t hear them our devices can so naturally a group of researchers came up with an idea to hack our smart appliances using ultrasonic voice commands a paper from University presented a new inaudible attack Vector on speech recognition systems called dolphin attack the researchers were able to hack just about any voice assistant they threw their commands app Siri Google Now Samsung Voice Huawei has a powerful voice.

As proofs of concept, Cortana and Alexa the attacks were able to activate Siri on an iPhone to initiate a FaceTime call, command Google Now to turn on airplane mode, and manipulate Audi’s navigation system. Their attacks appeared to have no device access, no owner interaction, and complete inaudibility using commercially available speakers. Dolphin attack may perform a variety of silent hacks. It can instruct a device to enter a militia’s website, which then installs malware on the victim’s device. The assault can also employ phone conversations to eavesdrop on the victim. it can populate a phone with fake messages calendar events emails or other information turning on an airplane mode can trigger a denial of surveys and lastly the dolphin attack can conceal Itself by dimming the screen and lowering the volume the only limitation of this proposal was range their distances varied from two centimeters to 175 centimeters so naturally another research group from the University of Illinois picked up the slack and proposed ways of extending the dolphin attack range now let’s ask the same question using inaudible acoustics the United States capital city is Washington D.C using an array of multiple speakers the attackers were able to use the same dolphin attack method to achieve the distance of about 25 feet they were able to carry out these attacks from outside the victim’s home and bypass voice fingerprinting protections by brute forcing synthesized voice signal of the owner the dolphin attack uses air to carry the sound waves of the ultrasonic frequencies which usually means the militia speaker needs to be within the line of sight obstructions within that line can significantly reduce performance of the dolphin attack luckily other materials such as the ones our table tops are made of can also carry sound and because the rule if it exists it can be hacked applies a new group of scientists volunteered to develop yet another attack Vector named surfing attack the new hair can leverage the unique properties of acoustic trans mission in solid materials to tag voice control devices over a longer distance and out of line of sight the new design allows for omnidirectional transmission multi-round interactions between the attacker and the target device longer attack range of course and the lower power requirements surfing attack can instruct a Target device to stealth through the league secret information to the attacker for example an injected ultrasonic command can tell a voice assistant to relay a two-factor authentication code back to the remote attacker this two-way transmission is a new addition of the surfing attack because the design also contains a tapping device that can capture the relay information without the victim noticing surfing attack doesn’t require any special skill or knowledge and the equipment used is commercially available for just a few bucks with these advancements ultrasonic attacks and voice control devices are virtually Unstoppable it doesn’t matter what objects on your desk or what type of material they’re made of range has been vastly extended at a point you would never be aware of harmful equipment in your neighborhood, then what can you do to reasonably defend yourself from these assaults, while the best consequences are to deactivate voice input?

Some technologies can silence microphones or even disconnect power to the microphones, which can effectively cease both surfing and dolphin attacks. This also negates the point of having voice help. The always-on listening feature is the most vulnerable, so disable it if your device has it. requests that all voice commands work only when your phone is unlocked if you think these attacks were require dedication and commitment don’t ultrasonic transmission is already widely implemented by the advertising industry for a cost for cross-device tracking ultrasonic beacons are constantly playing in all kinds of media from digital ads to movie theatres and Commercial banners they constantly talk to your device to track its unique identifiers and add performance this Builds on scientific research proving that ultrasonic transmission between Airgas machines is entirely plausible that is even if your phone is not connected to the internet ultrasonic beacons can still extract information from it at the rate of 20 bits per second I have a dedicated video for Ultrasonic cross device tracking if you want to learn more about this topic the biggest takeaway from this is that voice control devices introduce new vulnerabilities and attack vectors the more we surround ourselves with microphones the more exploitation we’ll be exposed to our voice control devices are equipped with microphones with a peculiar design flaw inside the microphone is a diaphragm which is a small plate that moves when sound waves hit it for seven months researchers from Japan in the University of Michigan were studying these microphones and realized that the diaphragm can also be moved by focusing light at it this is because when the light hits the diaphragm its movement is converted to electric signals which the device can interpret as voice command as a proof of concept they were able to command a voice assistant to open a garage door by a beaming and Laser command from outside a window realizing that light can travel much further than ultrasounds they climbed on top of 14 Foot University Bell Tower and successfully commanded a Google home device inside another building 230 feet away when they couldn’t climb any further they took a telephoto lens to beam lasers to another Voice Assistant more than 350 feet away and still managed to take control of it this attack worked in Google Assistant Amazon Alexa Facebook portal and Apple Siri expect virtually any voice assistant to be vulnerable to this the attackers were able to perform a range of Novel attacks including taking control of a smart home switches opening smart garage doors making online purchases remotely unlocking and starting certain vehicles and opening smart locks by stealthily brute forcing the user’s pin number laser attacks are more on the pricey side as far as hijacking virtual assistance goes the full equipment will cost you North a 350 550 if you want to use a telephoto lens but the insanely long range of the attack is worth it presently the defense against this attack is limited covering your microphone with a tape wouldn’t help as some microphones are protected with a dirt shield and the laser light still went through Apple Google and Amazon would have to redesign their voice assistance from scratch you can mute your microphone which would work but also disable your device’s functionality the command injection makes no noise but the light being team can be visible if you can hide your device from outside windows you might be able to mitigate these attacks however covering it will not be sufficient as a powerful enough laser will pass through many physical barriers enabling speaker recognition will only protect you against malicious activation once your device is activated by you it will listen to the malicious light commands as well you should use a strong pin but keep in mind that it can be stealthy Brute Force by light commands voice assistants are not something I want to surround myself with but being realistic about this you’re more likely to get hacked by opening malicious file in an email attachment or get your credit card details fetched on a spoofed website then have your Alexa or Siri hacked the mass surveillance conducted by Apple Google Facebook and the rest of the big tag is a far more immediate concern than hijacking voice assistance this is where the ultrasonic cross device tracking is useful and I recommend you learn more about this from my video on this topic I’ll be much more inclined to use Virtual assistants if they were open source and respect acting my user choice in privacy Mozilla deep speech in Minecraft are trying to provide open source solutions to speech recognition systems these projects have already matured enough to hit the mainstream but they would still be equally vulnerable To all of the attack methods described in the research papers cited in this video, I would only trust these devices when they are offline and have strong security measures built in by default. When it comes to privacy and security, less is often more, but if you want a lot more of my content, join my pages.

Feel Free to comment your conclusion.

Mr. Innocent will be back with another article containing Short and Crisp content shortly. Hey, are you there…? Listen, if you didn’t grasp this one at first, please correct me if you noticed any bugs, and I am delighted to accept your remarks as well, and think in your viewpoint to educate me, since I (Winning Looser’ s) have own negative notions.

Follow me in medium and here is my LinkedIn as well…Keep an Eye.

https://www.linkedin.com/in/eswarnekkalapu/

Cheers guys Have a good one.

©Copyrighted. E s W A r ‘N.