IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Alexa, Siri, Cortana vulnerable to "silent hacking"

Inaudible voice commands could be used to take over virtual assistants and smart speakers, researchers find

waveform

Smart speakers from some of the industry's leading companies have been found to be vulnerable to an exploit that allows hackers to take control of a device by issuing silent commands.

Researchers at Zhejian University in China recently discovered a technique known as "DolphinAttack", which involves modulating the sounds of an individual's voice so that they are inaudible to human ears, but are still capable of issuing commands to a speaker.

The microphones built into some of the most popular home speakers, including the Amazon Echo and Google Home, and common consumer devices like tablets and laptops, are able to pick up the inaudible commands and perform tasks seemingly at random to their user.

Specifically, the attack is able to send commands using ultrasonic frequencies in a range above 20,000hz, something that a human voice can't possibly recreate or listen out for.

In lab tests at the university, researchers were able to demonstrate the trick with smart assistants developed by Google, Amazon, Apple, Microsoft, and Huawei. The tests allowed researchers to not only turn on each device, but activate functions such as airplane mode, opening websites and more importantly, interact with any smart home device linked to the speaker.

Smart devices are becoming increasingly popular additions to homes, however the vulnerability raises concerns that appliances such as smart locks or connected thermostats could be silently controlled by a hacker.

Unfortunately, the process of modulating a voice and playing back audio at high frequencies can be performed using various devices that cost as little as $3, according to the researchers. However, in order for the process to work, a hacker needs to be within six feet of the targeted speaker and to go entirely undetected, the speaker would need to be unlocked first, otherwise a tone would alert the user to a command.

The researchers recommend device manufacturers and developers should ensure that commands issued at frequencies that are impossible for humans to communicate in are ignored.

Featured Resources

ZTNA vs on-premises VPN

How ZTNA wins the network security game

Free Download

The global use of collaboration solutions in hybrid working environments

How companies manage security risks

Free Download

How to build a cyber-resilient business ready to innovate and thrive

Outperform your peers in your successful business outcomes

Free Download

Accelerating your IT transformation

How Cloudflare is innovating for CIOs to start 2023

Watch now

Most Popular

Tech pioneers call for six-month pause of "out-of-control" AI development
artificial intelligence (AI)

Tech pioneers call for six-month pause of "out-of-control" AI development

29 Mar 2023
3CX CEO confirms supply chain malware attack
malware

3CX CEO confirms supply chain malware attack

30 Mar 2023
Getting the best value from your remote support software
Advertisement Feature

Getting the best value from your remote support software

13 Mar 2023