Smart speakers can be manipulated with inaudible voice commands

[Irving]

I know there are a lot of paranoid people on here, so here is an article to give more concrete reasons to be worried about emerging technology. The article is about smart speakers or other listening devices that will react to voice commands that cannot be heard by people.

https://mobile.nytimes.com/2018/05/1...o-attacks.html

Excerpt:

BERKELEY, Calif. — Many people have grown accustomed to talking to their smart devices, asking them to read a text, play a song or set an alarm. But someone else might be secretly talking to them, too.

Over the past two years, researchers in China and the United States have begun demonstrating that they can send hidden commands that are undetectable to the human ear to Apple’s Siri, Amazon’s Alexa and Google’s Assistant. Inside university labs, the researchers have been able to secretly activate the artificial intelligence systems on smartphones and smart speakers, making them dial phone numbers or open websites. In the wrong hands, the technology could be used to unlock doors, wire money or buy stuff online — simply with music playing over the radio.

[CS1983]

Moreover, it could be used to engage in criminal activity such that it appears the person who is a target for .gov did X action did so themselves with no alibi otherwise, leading to a conviction with no recourse.

Vocal critic of something and a thorn in the side of Uncle Scam? Why, you snuff/kiddie porn addict. AND you also visited known jihadist websites. AND you (insert here)? You're goin' to jail little fella!

Never mind that *you* never visited such content in your life.

[mattiooo]

Moreover, it could be used to engage in criminal activity such that it appears the person who is a target for .gov did X action did so themselves with no alibi otherwise, leading to a conviction with no recourse.

Vocal critic of something and a thorn in the side of Uncle Scam? Why, you snuff/kiddie porn addict. AND you also visited known jihadist websites. AND you (insert here)? You're goin' to jail little fella!

Never mind that *you* never visited such content in your life.

This already happens and with simple hacking. You don't need elaborate tech exploits and workarounds to accomplish this, just a 13 year old with the right skill set.

[CS1983]

This already happens and with simple hacking. You don't need elaborate tech exploits and workarounds to accomplish this, just a 13 year old with the right skill set.

Yes, but another vector for it to be accomplished more easily is a problem.

Imagine this technology being used in a broad-brush manner against, say, Congress or really any high profile target when directly hacking them is more difficult.
Why shoot a dart when you can simply mist the air with poison?

[mattiooo]

Yes, but another vector for it to be accomplished more easily is a problem.

Imagine this technology being used in a broad-brush manner against, say, Congress or really any high profile target when directly hacking them is more difficult.
Why shoot a dart when you can simply mist the air with poison?

When it evolves, it may well be. Right now, with having to be in the same location as the device, I think it's the more difficult process, and I'd worry more right now about remote breaches. The good news is we're constantly evolving the defenses as the technology evolves. The good guys are always catching up, but we at least keep the bad guys having to find new ways.

Where there is a will, there is almost always a way. Especially if laws are not something you worry about.

[Irving]

I forgot to post that while I don't have any smart speakers, I do have a smart phone, which is the same thing. I don't think most of us will have much of a choice as that technology will be integrated into future purchases whether we like it or not.

[Gman]

This is old news that was made public in September of last year. The microphones could pick up ultrasonic sounds that people can't hear. Most of the vendors of such speakers have added frequency filters to avoid this problem.

The original exploit required physical access to the devices, so if someone is in your home doing this, then you may have bigger problems.

[hollohas]

The original exploit required physical access to the devices, so if someone is in your home doing this, then you may have bigger problems.

This. I would think inaudible commands would have to be transmitted from inside your home.

And if they figure out a way to transmit commands from outside my home, the moment my Amazon Echo tells me it's turning down my AC without me asking, it gets limited to music playback.

[Irving]

This. I would think inaudible commands would have to be transmitted from inside your home.

And if they figure out a way to transmit commands from outside my home, the moment my Amazon Echo tells me it's turning down my AC without me asking, it gets limited to music playback.

Great idea except whoops, the entire point of the article.

A group of students from University of California, Berkeley and Georgetown University showed in 2016 that they could hide commands in white noise played over loudspeakers and through YouTube videos to get smart devices to turn on airplane mode or open a website.

This month, some of those Berkeley researchers published a research paper that went further, saying they could embed commands directly into recordings of music or spoken text. So while a human listener hears someone talking or an orchestra playing, Amazon’s Echo speaker might hear an instruction to add something to your shopping list.

[CS1983]

The smart thing is not to attach one's life to the IoT.