A few years ago, we previously heard of DolphinAttack targeting voice assistants to hack smartphones and other devices. Now, researchers have come up with another strategy to take over smartphones, the ‘SurfingAttack’. As discovered, SurfingAttack controls voice assistants by exploiting ultrasonic waves, to take control of the device.
A team of researchers has recently elaborated on SurfingAttack – a tactic to hack devices via voice assistants. This attack leverages ultrasonic waves to send commands to voice assistants.
Brief, in their study, the researchers minimized the limitations of transmittance of ultrasonic radiations to target a certain device. While the previously reported attack methods similar to this one, such as the DolphinAttack, involved over-the-air transmission of radiations, SurfingAttack transmits ultrasound waves via material surfaces, such as tabletops. This approach makes the attack possible over large distances and in any direction without necessarily requiring the target device to be in line-of-sight.
Conducting such attacks allows an adversary to steal sensitive details from the target devices, such as smartphones or tablets. The attacker can send inaudible voice commands in ultrasound waves to the device, minimize the device volume, and then capture the information leaked by the voice assistant. The entire attack would continue without attracting the victim user’s attention.
To validate their findings, the researchers set up a prototype of the attack device with a low-cost PZT transducer. Hiding this attack equipment near the target device and generating guided waves allowed the researchers to send voice commands to the target device’s voice assistants. After waking up the voice assistant, such as Google Assistant or Siri, they could then carry out various activities, including stealing of information.
The following picture shows a possible SurfingAttack setup.
They tested 17 different smartphones and 4 tablets, among which, they successfully conducted SurfingAttack on 15 smartphones and 3 tablets. Specifically, the tested models included Google Pixel, Pixel 2 and 3, Motorolla G5 and Z4, Samsung Galaxy S7 and S9, Xiaomi Mi 5, Mi 8, and Mi 8 Lite, Huawei Honor View 10, and Apple’s iPhone 5, 5S, 6+, and iPhone X. Whereas, the evaluated operating systems included Android 7.0, 8.0, 9.0 and 10.0, and iOS 10.0.03, iOS 11, iOS 12.1.2, and iOS 12.4.1.
Their attack setup included different surface materials such as aluminum/steel, glass, and medium-density fiberboard (MDF). For the former two surfaces, they also evaluated the results against different thicknesses.
The following video quickly demonstrates how attackers can exploit target devices by conducting SurfingAttack.
The detailed strategy of conducting such attacks is available in the researchers’ paper . Whereas, they have also set up a dedicated website where they have shared videos demonstrating various attack scenarios.
While SurfingAttack is hard to detect by an average user, researchers have advised various mitigations to prevent such attacks. These include,
Recently, researchers also demonstrated LightCommands attack exploiting voice assistants to hack smartphones, smart devices, and others. This attack involved the use of laser light to inject voice commands by exploiting a vulnerability in MEMS (microelectromechanical systems).
unicc reddit the dump furniture store near me