Radio Waves Can Be Used To Hijack Androids and iPhones Via Siri and Google Now

An anonymous reader writes: Two French researchers have discovered a way to use the Siri and Google Now voice assistant software to relay malicious commands to smartphones without the user's consent or knowledge. This method relies on a special hardware rig that can send radio waves to smartphones with earphones plugged into them. The radio waves get picked up by the earphone cable, get transformed into electrical signals and then to software commands. The research is accompanied by a YouTube video as well. Note that this attack, as the article explains, so far relies on some bulky dedicated equipment, and on the attacker being close to the system he wants to disrupt.

Comments

Re: Bad headline

[BronsCon]

Actually, good headline. Had you read the summary, you'd know that this attack requires a wired headset to be plugged in. Essentially (and wihout reading the article as I actually did something similar a few years back), they're sending an AM signal to the device via tha headphone cable at a multiple of the sample rate being used by the device's ADC, fooling it into thinking the radio signal coming throuh the antenna is an audio signal. Rather than try to guess the sample rate, they probably transmit at a multiple of 8000 and 22050hz; 176.4mhz would cover 4000, 8000, 16000, 22050, 24000, 44100, 48000, and 96000hz, actually. IIRC, I used 705.6mhz and only needed a handful of watts; the device could have been made about the size of a small home router including batteries and an in-built mp3 player to relay commands, but battery life would have been short-ish.

What is it about a headset jack that makes a phone a cellphone, again? I mean, I recall having a 47mhz cordless phone with a headset jack. Was that a cellphone? No.

Risk

[fyngyrz]

You may be misunderstanding the risk, such as it is.

o Siri is given instructions via RF injection and incidental demodulation within the phone's mic input electronics.

o Siri performs an action you didn't ask it to do.

o You won't necessarily hear the instructions come in. In the cable, it's RF. Your earphones would also have to demodulate the signal. If they're purely inductive (most headphones are), they won't do that. If the circuitry they are plugged in to doesn't provide incidental demodulation (a lot less likely than an input like a mic input), it won't get back to the earphones that way either. Last chance is anything you say is fed back to your earphones by Siri / etc. Does it do that? My Galaxy Note 3 doesn't do that with Google voice. Why would it, anyway?

o If you're not looking at your phone, you might not even be aware this had happened. You might even be asleep. I nap with my earphones in, listening to music, on a fairly regular basis, for instance.

So while it's extremely unlikely to be any kind of an immediate threat because of the equipment and proximity issues, it actually might be able to cause problems in those rare cases where those issues do not prevent it. Mostly it depends on what the phone can be told to do, and what portion of that it will do without further interaction / confirmation.