6 ms·
SurfingAttack: attack on voice assistants using ultrasonic guided wave
- seiters 7y agoSurfingAttack exploits ultrasonic guided wave propagating through solid-material tables to attack voice control systems. Interesting!
- Jernik 7y agoThis requires the phone to be unlocked to do most of this, doesn't it? What is the attack vector here, someone leaving their phone unlocked on a table and not paying attention to the screen?
- arianvanp 7y agoGoogle phones push you hard in their UI wizards to enable auto-unlock when on "known wifi" networks.
- clSTophEjUdRanu 7y agoI've owned nothing but "Google phones" since the Nexus 4 and don't know what you're talking about. Do you mean smart unlock? Pushing hard is pretty subjective, I don't see a "hard" push to turn off security features. As a matter of fact I've seen warnings about disabling the lock screen.
- JakeTheAndroid 7y agoMy Pixel 3 prompted me to turn off the auto-locking feature when I was at home because it saw that I unlocked my phone a lot in that geofenced location. It also did that at my old job as well since the situation was pretty similar. I would get this prompt about once a month. So I would agree, it's not a hard push, Google is def nudging people towards less secure logins. My S10+ asked me this same question about a week into owning the phone, but it never bothered me about it again once I declined. And at no point in either system was the I made aware of the risks I was accepting if I enabled it. So, not a Google specific issue, but it's a less than ideal approach considering how sensitive peoples phones are today.
- nl 7y agoI have had multiple Pixels, and have been prompted multiple times to turn on "smart unlock" when connected to my home WiFi network or to my smartwatch or within a geo area. It's unclear what "smart unlock" actually is, but as far as I can see it means my phone can be unlocked just with a swipe.
- seiters 7y agoNot necessarily. Both Android and iOS allow voice assistants to interact with phones for certain activities even without unlocking the phones. Typical scenario: someone puts a phone on the table and does something else (typing on a computer), not paying attention to the screen.
- dylan604 7y agoI know lots of people that have their phones set to not lock automatically. Some of these include not locking them when they throw the phone in their purse, or put it in their back pocket. "I can't be bothered to type in my password every time I pick it up" or "My kids bother me too often to unlock the phone." It's absolutely mind boggling
- circa 7y agoI know a lot of people who say that too. Its awful.
- iudqnolq 7y agoPassword? I've never met someone else irl who sets a password on their phone. Best I've ever seen is a PIN.
- pc86 7y agoThey obviously mean the same thing in this context.
- iudqnolq 7y agoIf you open the Android security settings you'll be asked if you want to set a password or pin. A password is longer and can contain arbitrary characters. I've never heard a person refer to a short series of numbers used to protect something as a password and not a pin.
- vgb2k18 7y ago> I've never heard a person refer to a short series of numbers used to protect something as a password and not a pin. Until today... Screenshot from Android phone - https://ibb.co/KD27YGL https://ibb.co/KD27YGL
- h4waii 7y agoEh, you should clarify that this is not an AOSP lockscreen. It looks like Huawei's EMUI, which is quite heavily modified and might simply be a translation error.
- ElijahLynn 7y agoThis isn't just phones.
- rvz 7y agoWell this is why you disable the "Ok Google" / "Hey Google" hotword or "Listen for Hey Siri" or always listening features and congrats you are immune to this attack. Job done for your phones. Perhaps a more interesting experiment would be to try this on Alexa, HomePods and Google Home devices.
- up6w6 7y agoThere is another very similar attack that uses laser beans instead of sound waves but this looks less efficient because of the distance limitation. https://news.ycombinator.com/item?id=21453554 https://news.ycombinator.com/item?id=21453554
- rickdeckard 7y agoThere's also the big difficulty to harvest laser beans... But seriously, I wouldn't say this one is less efficient, both attacks are quite different in scope. The laser-based attack requires line-of-sight to the device and apparently works only on stationary home-assistants (i.e. your Google Home), while this ultrasonic method explicitly targets Smartphones and has potential for wide unfocused attacks at public spaces (i.e. by rigging a table in a coffee-shop).
- paranoidrobot 7y ago> There's also the big difficulty to harvest laser beans... Especially considering it's lost or perhaps extinct. https://en.wikipedia.org/wiki/Silphium https://en.wikipedia.org/wiki/Silphium HN Discusson from a few days ago: https://news.ycombinator.com/item?id=22229666 https://news.ycombinator.com/item?id=22229666
- deleted 7y ago[deleted]
- hansschouten 7y agoInteresting attack. Reminds me of the DolphinAttack (https://arxiv.org/abs/1708.09537 https://arxiv.org/abs/1708.09537)
- anfractuosity 7y agoAlso there's the 'Audio Hotspot Attack' - https://ieeexplore.ieee.org/document/8906174 https://ieeexplore.ieee.org/document/8906174 Which uses a parametric speaker, which uses a number of ultrasonic transducers which "emit amplitude-modulated ultrasounds that will be self-demodulated in the air"
- ElijahLynn 7y agoWas thinking about this the other day, when I heard the assistant trigger when there was _zero_ sound to prompt it. And was thinking of an attack where someone can literrally trigger a listen from outside your house. Especially dangerous because the default on a new Google Home (max hub nest truck whatever they call it) is to not have an audible prompt on a trigger. So an attacker can literally just listen in with a press of a button. Probably gonna have to turn off this feature altogether for the immediate future.
- jmole 7y agoHow exactly are they going to listen in? Are they on the other end of the line?
- nateferrero 7y agoIf they can get it to listen, they can theoretically have it dial a number
- squarefoot 7y agoOr call for a fake SWAT raid to the same house, so that the owner is either being shot or imprisoned. If that can really be triggered from distance without breaking in, it would make it the perfect revenge weapon.
- Kiro 7y agoWhy would you need this hack to Swat someone?
- squarefoot 7y agoI surely don't want to swat anyone. My concern is that someone with the right technology might use (1) this vulnerability to call a raid to an "enemy" from its own assistant without breaking in or leaving digital traces: no fingerprints, no malware installed, essentially no smoking gun, therefore creating a scenario in which the home owner might either be shot during the raid or prosecuted for calling a false alarm. (1) - and if successful then sell the "service"
- ElijahLynn 7y agoReally great demo videos on the webpage, fwiw.
- snug 7y agoReminds me of the smarter every day video where Destin used lightwaves against smart homes https://www.youtube.com/watch?v=ozIKwGt38LQ https://www.youtube.com/watch?v=ozIKwGt38LQ
- Animats 7y agoComing soon to a Starbucks near you.
- trhway 7y agoIt worked well at the Cuban embassy https://spectrum.ieee.org/semiconductors/devices/how-we-reverse-engineered-the-cuban-sonic-weapon-attack https://spectrum.ieee.org/semiconductors/devices/how-we-reve...
- Bendingo 7y ago"Cuban “Sonic Weapon” Attack" --> "Jamaican field cricket or maybe cicadas" [0] [0] https://www.vanityfair.com/news/2019/01/the-real-story-behind-the-havana-embassy-mystery https://www.vanityfair.com/news/2019/01/the-real-story-behin...?
- emptybits 7y agoDisable your locked phone from always listening for "OK Google" or "Hey Siri". Protected, no? Their list of five ways to "defend against SurfingAttack" doesn't include this obvious one. i.e. If you want to give a voice command, pick up your phone and press a button to speak. Protected and still pretty darn convenient IMO. Otherwise, great project and succinct video proof of how clever conveniences often conflict with security.
- seiters 7y agoThanks for the comment. This defense works: but you have to remember to lock your phone when you put it down.
- ThePowerOfFuet 7y agoSiri can be used for many things when the device is locked.
- rvz 7y agoAbsolutely this. This is exactly the same advice I gave earlier to defend against this SurfingAttack and yet somehow I was downvoted for no reason. Oh dear...
- draugadrotten 7y agoNow I am thinking I could use this to automatically turn everyone's phone to "silent mode" when they put their phones on the conference room table...