Siri and Google Assistant hacked into new ultrasonic attack – Naked Security

Troubling news for everyone who relies on smartphone voice assistants: researchers have demonstrated how they can be secretly activated to make calls, take photos, and even read text messages without ever physically touching the device.

Double SurfAttack by a chinese-american university team, this is not a salon thing and is based on the ability to remotely control voice assistants using inaudible ultrasonic waves.

The voice assistants – the targeted demo Siri, Google Assistant and Bixby – are designed to respond when they detect the owner's voice after noticing a trigger phrase such as Ok, Google.

Ultimately, the commands are just sound waves, which other researchers have already shown can be emulated using ultrasonic waves that humans cannot hear, provided that an attacker has a line of sight on the aircraft and the distance is short.

SurfingAttack adds to this the possibility of sending the ultrasonic commands through a glass or solid wood table on which the smartphone was seated using a circular piezoelectric disc connected to its underside.

Although the distance is only 43 cm (17 inches), hiding the disc under a surface represents a more plausible and easier to conceal method of attack than previous techniques.

As explained in a video presenting the method, a remote laptop computer generates voice commands using the Text-to-Speech Module (TTS) to produce simulated voice commands which are then transmitted to the disc via Wi-Fi or Bluetooth.

Researchers tested the method on 17 different smartphone models from Apple, Google, Samsung, Motorola, Xiaomi and Huawei, successful deployment Surfing Attack against 15 of them.

Researchers were able to activate voice assistants, ordering them to unlock devices, take repeated selfies, make fraudulent calls, and even ask the phone to read a user's text messages, including verification codes SMS.

The responses were recorded using a concealed microphone after lowering the volume of the device so that this communication would not be heard by a user nearby in an office.