Hacking Siri

FastCoDesign:

> Chinese researchers have discovered a terrifying vulnerability in voice assistants from Apple, Google, Amazon, Microsoft, Samsung, and Huawei. It affects every iPhone and Macbook running Siri, any Galaxy phone, any PC running Windows 10, and even Amazon’s Alexa assistant.
>
> Using a technique called the DolphinAttack, a team from Zhejiang University translated typical vocal commands into ultrasonic frequencies that are too high for the human ear to hear, but perfectly decipherable by the microphones and software powering our always-on voice assistants. This relatively simple translation process lets them take control of gadgets with just a few words uttered in frequencies none of us can hear.

First things first, this is not terrifying. But it is interesting.

You can watch a demo in the video embedded below. Not sure there’s a software fix to prevent this. Seems to me the audio in processor would have to have access to the frequency of the audio coming in, then filter it if it was outside some specified audible range.

Not sure this threat, which seems relatively minor, is worth the effort.

Also, DolphinAttack, cool name.



14 thoughts on “Hacking Siri

  1. JF says:

    So… this terrifying attack is just a low-pass filter away from being dealt with?

  2. NB says:

    I’m shaking at the prospect of someone making my phone call my mom or my Echo uh…play music?

  3. Caleb Hightower says:

    Rather clever

  4. Tim says:

    Can’t remember which whitepaper, but recall one expressly conceded that with systems that are trained to a specific users voice (think Siri – where there’s a rudimentary function to only execute commands from a single person’s voice) you would basically have to train the phone to accept commands from the dolphin attack. Apparently it’s a much larger problem for systems that do not require voice training (e.g., alexa) that are generally designed to pickup voice commands from everyone).

  5. JimCracky says:

    Shelve any frequency above 17khz at the mic input.

  6. Kip Beatty says:

    Dave, how dare you tone it down. You’re supposed to make us run to buy voice modulators. Don’t you know how media works today? Keep ’em scared!

  7. 01shade10 says:

    This is less a threat and more a minor annoyance. “Siri, tell my wife she’s fat”. Good way to screw with your “friends”.

  8. Scott Lemolo says:

    Interesting. According to comments made by Shawn during the the whole Office 2011 debacle a few days ago, The Loop does not change the title of the original headline in a linked article. However, the headline for this story reads, “A Simple Design Flaw Makes It Astoundingly Easy To Hack Siri And Alexa.” Go figure.

  9. Dave Mark says:

    I suspect Shawn was speaking from his point of view. Personally, I do change headlines, but not as a matter of course. Usually it’s to soften something I see as clickbait (like this article), or because I want to make a specific point (like the evolution of selfies that focused on a specific part of an article).

    — Dave

  10. Shawn King says:

    Dave suspects correctly. My apologies for speaking for The Loop when I should have made it clear I was speaking only for myself. My stupidity should not be a reflection on Dave or Jim. 🙂

  11. James Hughes says:

    I’m just surprised someone is actually taking the time to post about how you and Dave differ in how you present articles. That’s some waste of time if you ask me.

  12. Shawn King says:

    Not really. I made a blanket statement representing The Loop (and shouldn’t have) and the OG called me on it. I have no problem with that.

  13. Only thing this can do is set an alarm at 3am. But just disable Siri on the lock screen and you’re fine.

  14. James Hughes says:

    I’m not saying he’s wrong, I just think its petty. The “go figure” at the end kinda made me wonder. But as we all know, interpreting tone is almost impossible in text, especially a quick post like here.

Leave a Reply

Your email address will not be published. Required fields are marked *