SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow1937
Hacks are often caused by our own stupidity, but you can blame tech companies for a new vulnerability. Researchers from China's Zheijiang University found a way to attack Siri, Alexa and other voice assistants by feeding them commands in ultrasonic frequencies. Those are too high for humans to hear, but they're perfectly audible to the microphones on your devices. With the technique, researchers could get the AI assistants to open malicious websites and even your door if you had a smart lock connected.
The relatively simple technique is called DolphinAttack. Researchers first translated human voice commands into ultrasonic frequencies (over 20,000 hz). They then simply played them back from a regular smartphone equipped with an amplifier, ultrasonic transducer and battery -- less than $3 worth of parts.
What makes the attack scary is the fact that it works on just about anything: Siri, Google Assistant, Samsung S Voice and Alexa, on devices like smartphones, iPads, MacBooks, Amazon Echo and even an Audi Q3 -- 16 devices and seven system in total. What's worse, "the inaudible voice commands can be correctly interpreted by the SR (speech recognition) systems on all the tested hardware." Suffice to say, it works even if the attacker has no device access and the owner has taken the necessary security precautions.
Source: https://www.engadget.com/2017/09/06/alexa-and-siri-are-vulnerable-to-silent-nefarious-commands/
(Score: 1) by Tara Li on Thursday September 07 2017, @05:13PM (5 children)
Or it could even be done at the cloud level, since the devices are doing no speech recognition of their own - they just ship the data off to the cloud, and get a data stream in return to be played. I expect the devices *could* have been implemented in the 80386 days, honestly.
(Score: 0) by Anonymous Coward on Thursday September 07 2017, @05:50PM (1 child)
Which makes me wonder why they didn't get this security fix for free by sampling at a rate that wouldn't include those frequencies, ie capture a 40kHz stream and everything above 20kHz has to be fitlered out to avoid aliasing artifacts.... Are they sending 48 or 96 kHz just so this hack works?
(Score: 3, Funny) by bob_super on Thursday September 07 2017, @06:54PM
Wouldn't want to miss some the ultrasonic audio processing which tells them whether you're banging or just murdering someone.
You don't want to accidentally get bleach when you need acid.
(Score: 3, Informative) by VLM on Thursday September 07 2017, @06:54PM (2 children)
The game that's being played is non-linear mixing, so the cloud won't help. The problem is the mic and preamp before the cloud hears it.
So you feed less than 10 volts of 42 KHz and 44 KHz ultrasound thru a top quality audio mixing board and you get ... 10 volts of 42 KHz and 44 KHz at the output. Very linear. Not a peep at 2 KHz even though 10 volts is over spec a bit.
Anything non-linear, like a preamp running right at the ragged edge, will result in some level of mixing products being generated, so 10 volts of 42 KHz and 10 volts of 44 KHz in the preamp of an Alexa, given that Alexa isn't a studio quality ultra high linearity mic and soundboard, will result in a horrendous distorted mix of 42 KHz, 44 KHz, and 2 KHz (and also 86 KHz, and harmonics...)
Kinda like an audio amp driven into distortion often (not always) blows the tweeters not the woofers.
(Score: 1) by Tara Li on Thursday September 07 2017, @07:09PM (1 child)
Soooo... They're getting some kind of harmonic that just happens to be in the voice range?
(Score: 2) by VLM on Friday September 08 2017, @01:27AM
exactly yes. nonlinearity in the analog stuff makes a nice mixer... Most electronics are very linear until they aren't (at high levels or whatever)