Slashdot Mirror
Radio Waves Can Be Used To Hijack Androids and iPhones Via Siri and Google Now
An anonymous reader writes: Two French researchers have discovered a way to use the Siri and Google Now voice assistant software to relay malicious commands to smartphones without the user's consent or knowledge. This method relies on a special hardware rig that can send radio waves to smartphones with earphones plugged into them. The radio waves get picked up by the earphone cable, get transformed into electrical signals and then to software commands. The research is accompanied by a YouTube video as well. Note that this attack, as the article explains, so far relies on some bulky dedicated equipment, and on the attacker being close to the system he wants to disrupt.
Ask someone's Siri where the horse dick is. Ask someone's Siri where the hard drugs are. Ask someone's Siri where the inflateable dolls are. Make sure you target politicians, you pranksters...
Since the researcher did not try to see whether the same trick would work on a Lumia
This attack is a good example of why I never wear headphones when listening to music on my phone. I just blare my music instead, which might annoy some people around me but actually I am doing them a favor by exposing them to culture and expanding their horizons. And anyway it is obviously the ONLY thing I can do to stay safe from this attack....so.....
Use BlueTooth headphones/headsets.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
they can use radiowaves to remotely control and tap into/scan anything, even DRAM, CPU, brain/nerves, USB, keyboard, monitors.
the technique is called interferometry/electronic warfare but also you can do it with off the shelf parts. they call the off the shelf stuff van eck phreaking: https://en.wikipedia.org/wiki/...
More info on the interferometry/electronic warfare kind used by our government from space satellites and over the horizon radar at http://www.drrobertduncan.com/
Info on interferometry: https://en.wikipedia.org/wiki/...
Electronic warfare: https://en.wikipedia.org/wiki/...
Signals Intelligence: https://en.wikipedia.org/wiki/...
RADAR MASINT: https://en.wikipedia.org/wiki/...
Welcome to the high tech age hidden by Edward Snowden, only talked about by real whistleblowers like Russ Tice, and Dr. Robert Duncan.
Actually, good headline. Had you read the summary, you'd know that this attack requires a wired headset to be plugged in. Essentially (and wihout reading the article as I actually did something similar a few years back), they're sending an AM signal to the device via tha headphone cable at a multiple of the sample rate being used by the device's ADC, fooling it into thinking the radio signal coming throuh the antenna is an audio signal. Rather than try to guess the sample rate, they probably transmit at a multiple of 8000 and 22050hz; 176.4mhz would cover 4000, 8000, 16000, 22050, 24000, 44100, 48000, and 96000hz, actually. IIRC, I used 705.6mhz and only needed a handful of watts; the device could have been made about the size of a small home router including batteries and an in-built mp3 player to relay commands, but battery life would have been short-ish.
What is it about a headset jack that makes a phone a cellphone, again? I mean, I recall having a 47mhz cordless phone with a headset jack. Was that a cellphone? No.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
So. Nay, varlet.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
"OK Google, begin DDoS script."
Imagine rolling through Times Square on New Years. Omnidirectional antenna on a micro version of this, get in the middle of the crowd, pwn everyone using wired headsets with a microphone, instant cellular botnet, and since you're not issuing commands from a cell phone or through the cellular network, you're not going to be traceable through that system.
You are effectively an invisible and untouchable attacker/control/command server. All you do is issue the command in a quick burst and go silent.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
OK, this is the sort of question that could be answered by RTFA, however when it's a 40-minute long video, I don't feel as bad.
When configuring Siri for voice activation, you go through some steps that give the impression that it's tuning the activation for your specific pattern of speech. Which presumably is to prevent false activation when somebody next to you is using the feature on their phone.
Assuming this is actually happening, would that prevent this sort of attack?
Just have Siri or Ok Google say something whenever interpreting a voice command. Something simple like "OK Boss," would let the user know something is going on with their phone.
Which, of course, leaves the problem of how a non-tecvh-savy person would know that when your phone is doing weird shit you unplug the headphones, which is probably the harder thing to figure out, but hey.
Would this phenomenon explain why I've had a few times when amplified computer speakers have received and output radio stations? It's only happened a couple of times in the twenty years that I've played with computer speakers, but it's been really weird.
Do not look into laser with remaining eye.
Time for an aftermarket add-on that goes in the phone jack that contains a low pass filter. Inductors, capacitors, pcb, input jack, output spike/plug, case.
If the paranoia grows sufficiently (or the threat actually does), it could be quite a moneymaker. You could probably sell a bunch at a premium to the various TLAs either way, as some of them are what one could reasonably describe as "professionally paranoid."
Fancy ones could have a LED that lights up using the shunted RF energy. A LED! Imagine that!
Or you could build in a thingy that wraps around the phone case over to right next to the camera, and when the LED goes off, it could be detected by the camera, and the phone could vibrate. No, wait, that means someone might be able to remotely sex you up. That's no good.
Really fancy ones could have a LED that lights in the infrared band, so no one could see it but the owner, using some fancy active spy/eyeglasses. Well, and the guy with the infrared scope on his sniper rifle. So perhaps not. :)
Of course, the business model will fall flat on its face when iPhone X / Android hardware X comes out with said RFI filtering built-in. and a detection that can drive the LED, an app, etc.
Ok, look. Let's just get rid of this researcher so This Can Never Happen Again*
-------------
* All due respect to South Park's 2D inhabitants and their observatory-destroying ways
** No need to thank me, I plan to continue to use my engineering design chops to secure the Safety Of Our Nation.
*** JFC, now I can't get my tongue out of my cheek. This getting old shite is getting old.
I've fallen off your lawn, and I can't get up.
You may be misunderstanding the risk, such as it is.
o Siri is given instructions via RF injection and incidental demodulation within the phone's mic input electronics.
o Siri performs an action you didn't ask it to do.
o You won't necessarily hear the instructions come in. In the cable, it's RF. Your earphones would also have to demodulate the signal. If they're purely inductive (most headphones are), they won't do that. If the circuitry they are plugged in to doesn't provide incidental demodulation (a lot less likely than an input like a mic input), it won't get back to the earphones that way either. Last chance is anything you say is fed back to your earphones by Siri / etc. Does it do that? My Galaxy Note 3 doesn't do that with Google voice. Why would it, anyway?
o If you're not looking at your phone, you might not even be aware this had happened. You might even be asleep. I nap with my earphones in, listening to music, on a fairly regular basis, for instance.
So while it's extremely unlikely to be any kind of an immediate threat because of the equipment and proximity issues, it actually might be able to cause problems in those rare cases where those issues do not prevent it. Mostly it depends on what the phone can be told to do, and what portion of that it will do without further interaction / confirmation.
I've fallen off your lawn, and I can't get up.
Yeah, it's the same idea. Microphone inputs are much more sensitive than speakers, so it happens a lot if you use a long mic cable but don't use the correct type, or if a connection is broken in the mic cable.
Am radio is basically the audio signal added to the radio signal. An antenna is a wire, and a wire is an antenna. So if you have a wire hooked up to a sound input which somehow does process the radio signal (such as by not being fast enough to do so), you can easily end up with just the AM audio coming through the wire/antenna to the audio input.
Nope. That's the fillings in your teeth. /s
"So long and thanks for all the fish."
No, it's a bad headline because if fails to distinguish the attack mechanism from what I said.
Alright, Mr. Smartguy, care to suggest a better headline?
This headline accurately describes the issue. Of course it lacks the detail required to fully understand the issue, that's what the article is for; the summary should serve to provide enough detail to help determine whether the article might be interesting, and it also succeeds in its job.
There are plenty of opportunities to poke at Slashdot's "editorial" staff. This, however, is not one of them.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Just say'n.
RF pickup by wired headsets can be used to compromise smartphones.
Mentioning the brands of phone and AI assistant is superfluous, as those specifics can easily be swapped out for other smartphones as long as they can download any sort of command AI. It's the pickup approach that's novel. Put "that accept voice commands" if you wish to elaborate further.
Also, I did not attempt to determine nor indicate the source of the headline. just that it was bad.
I'd love to lean into the mic at a packed concert and say, "Ok Google, call mom, yes ... Hold the tourniquet tight while I find the vein."