Light Commands: Hack attack on speech assistants by laser beam

[Ulquiorra]

 

In the past, we have already reported on the hackiness of smart systems, especially language assistants. So security researchers are increasingly succeeding in expanding and perfecting these methods of attack, as here with Light Commands. Researchers at the University of Michigan have succeeded in using a laser to control speech assistants completely unnoticed, reports arstechnica.

Light commands are aimed at language assistants

Light Commands LogoSiri, Alexa, and Google Assistant are vulnerable to attacks that inject inaudible and invisible commands into the devices using laser beams. This will secretly cause them to open garage doors, visit Web sites, or locate, unlock, and launch vehicles such as Tesla and Ford when the vehicles are connected to the Google Account's target of attack Controlling smart home switches, opening smart locks by taking advantage of user PINs, and shopping can be done online, according to the research report "Laser-based Audio Injection Attacks on Voice Controlled Systems." The attack, called Light Commands, also works on smartphones and tablet PCs, including the iPhone XR and the Samsung Galaxy S9, as well as a variety of other phones.

Novel attack mode based on physical laws

For this novel attack mode researchers use physical laws to hack. They explain it this way: "Microphones convert sound into electrical signals. The most important finding behind the laser commands is that microphones, in addition to the sound, also react directly to light directed at them. By modulating an electrical signal in the intensity of a light beam, attackers can cause microphones to generate electrical signals and use them as if they were receiving real audio signals. "It is implemented by directing a low-frequency beam at a voice assistant. They are used to enter and transmit inaudible signals from a distance of up to 110 m (360 feet). The language assistant responds to it and executes the received commands accordingly. Among other things, light-based commands can be sent from one building to another and even penetrate through glass when a compromised device is stored near a closed window.

Vulnerability is a vulnerability in microphones

The attack exploits a vulnerability in microphones that use microelectromechanical systems or MEMS. The microscopic MEMS components of these microphones unintentionally react to light as if it were sound. The researchers believe that all devices that use MEMS microphones are vulnerable to Light Commands attacks. Language assistants generally rely on voice interactions to receive voice commands. By directing a laser at its microphones, an attacker can effectively take over the speech assistant and send inaudible commands to Alexa, Siri, or Google Assistant. Light can easily travel long distances. As a result, the attacker is able to focus and aim the laser beam. The researchers demonstrated the attack in a 110-meter corridor.

functionality

For light commands to work, careful aiming and focusing with the laser are prerequisites. To align the laser over long distances exactly to a point, you can use a commercially available telephoto lens. For aiming you recommend a tripod head with gear. This increases the accuracy considerably. To detect the microphone ports of the device at great distances, the use of a telescope or binoculars is sufficient.

Process constraints

The laser-based attacks have several limitations. First, the attacker must have a direct line of sight to the target device. On the other hand, in many cases, the light must be aimed precisely at a specific part of the microphone. Except in cases where an attacker uses an infrared laser, the lights are also well visible to nearby people and looking at the device. In addition, devices typically respond with voice and visual cues when executing a command. This feature alerts users within earshot of the device.