Smartphones are devices at risk, and few doubts remain about that today. The best the average user can hope for is to be very careful with what they download and to limit their activities to official environments. But now, a new study published by Georgetown University explores the possibility of a remote attack through direct commands to assistants like Google Now, Siri, and Cortana. The most striking thing is that these commands are transmitted by a distorted, almost demonic voice that in theory could be hidden inside a YouTube video or another audio source.
Voice recognition advancements and hidden vulnerabilities
Advances in speech recognition have been extraordinary and have completely changed the way we use our mobile devices today. But as assistants extend their reach and incorporate more commands, the probability of finding a vulnerability also increases. Unless the user has a device like the Moto X, the logical thing is to manually invoke the assistant and then speak to it, but that's the key: if the assistant is in the foreground and ready to receive commands, anyone could speak to it, even a YouTube video specially prepared to distribute malware.
While this is a very special operating condition, the group of researchers from Georgetown University and the University of California (Berkeley) who prepared this study highlights the potential of viral videos. If for every million views there are ten thousand users who left their smartphone near the speakers, and half of them correctly interpret the order to open a malware-laden URL, it would be possible to speak of five thousand infected devices. These hidden commands are transmitted with a highly distorted voice and a certain demonic profile that can even achieve its goal in environments with background noise.
The study has an official page (link below) where several white-box and black-box demos were published for all interested parties to test with their smartphones. I insist that this is not an exact solution, and I estimate that the smartphone will fail to recognize the commands most of the time. However, we know well that malware only needs to get lucky once.
