A team of security researchers from the University of California, Berkeley, and Georgetown University has found a new method for hacking mobile devices by using hidden voice commands embedded in YouTube videos.
The only thing the victim has to do in order its mobile device to be hacked, is to watch a specific crafted YouTube video which contains hidden voice commands. The victim can watch the video from various nearby sources, including a laptop, a computer, a smart TV, a smartphone or a tablet. The hidden commands are received by Google Now or Siri personal assistant which filter them from noise and sounds and execute them after that.
The team of security experts published the details of the technique for hacking mobile devices in a paper called “Hidden Voice Commands”.
“We explore in this paper how they can be attacked with hidden voice commands that are unintelligible to human listeners but which are interpreted as commands by devices. We evaluate these attacks under two different threat models.” states the introduction of the project. “In the black-box model, an attacker uses the speech recognition system as an opaque oracle. We show that the adversary can produce difficult to understand commands that are effective against existing systems in the black-box model. Under the white-box model, the attacker has full knowledge of the internals of the speech recognition system and uses it to create attack commands that we demonstrate through user testing are not understandable by humans. We then evaluate several defenses, including notifying the user when a voice command is accepted; a verbal challenge-response protocol; and a machine learning approach that can detect our attacks with 99.8% accuracy.”
In October 2015, a similar attack was registered by the Intelligence French agency ANSSI. At that time, a team of security researchers found that a cyber criminal can fully control mobile devices from as far as 16 feet away.
The attackers can remotely hack a smartphone by silently transmitting radio commands to the voice control systems implemented by both Apple and Google, the Apple’s Siri and Android’s Google Now.
The hack was working only if the targeted device has the headphones plugged into its jack, under these conditions the attack works without even speaking a word.
“The possibility of inducing parasitic signals on the audio front-end of voice-command-capable devices could raise critical security impacts,” the two French researchers, José Lopes Esteves and Chaouki Kasmi, explained.
The hack utilized:
1. A mobile device, an iPhone or Android handset, that need to have headphones plugged into the jack.
2. A radio transmitter.
Presently, the experts have published a video PoC of the black box attack being carried out in presence of background noise with the target phone kept at a distance on 10.1 ft away from the speakers used to play the attack audio. The hackers can hide a few types of commands in the videos, including instructions to download and install a malicious code from a certain host.
Security experts suggest a series of countermeasures, including a notification every time a voice command is received by the mobile or the adoption of a verbal challenge-response system.
