Shining lasers at voice assistants like Alexa and Siri, researchers from Michigan and Japan achieved a hack where lasers had the power of commands from the human voice.
By shining the laser through the window at microphones inside devices like tablets, or phones, a far away attacker can remotely send inaudible and potentially invisible commands acted on by Alexa, Portal, Google assistant or Siri.
Simply put, an attacker can hijack the voice assistant and send commands.
How did the team carry out light as sound? A vulnerability in microphones using micro-electro-mechanical systems (MEMS) is exploited. The MEMS components unintentionally respond to light as if it were sound, said Ars Technica.
What’s the worst that can happen? A lot. Ars Technica described the lasers injecting inaudible commands into the devices and surreptitiously causing them “to unlock doors, visit websites, and locate, unlock, and start vehicles.”
The researchers discussed their work in their paper published on Monday. “Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems” is by five authors with affiliations from the University of Michigan (four) and from The University of Electro-Communications, Japan (one).
