2 ms·
You'd have to be pretty quick to get information out of the phone before the user catches on, especially if you've just asked the user to watch a video. I just
by diminoten 12y ago
You'd have to be pretty quick to get information out of the phone before the user catches on, especially if you've just asked the user to watch a video.
I just don't see this as an effective means of controlling a phone, when your primary means of "infection" involve user action.
The paper even acknowledges this, though almost dismissively: "One potential limitation of GVS-Attack is that the victim may notice the voice command played by VoicEmployer and interrupt it."
That's like, the whole reason this attack isn't very useful except in specific situations. No one's going to be running their botnet via GVS-Attack, that's for sure.
- iguana 12y agoIt could be used as part of the process, for example to access a URL with an android exploit on it that the user would not normally visit. It could also detect periods of inactivity, or high background noise. This is a real attack vector not worth dismissing.
- diminoten 12y agoNo doubt, I just think the fact that the user is going to interfere with any direct exfiltration ruins this as a stand-alone attack. Your idea, however, is exactly the "missing piece" to this attack.