Audio Hotspot Attack Crosses the Ultrasonic Beams to Send Silent Commands to Voice Assistants

Researchers at Japan's Waseda University, National Institute of Information and Communications Technology, and RIKEN AIP have released a paper detailing a means of silently sending commands to voice-activated assistant systems like Alexa and Google Home, using directional ultrasonic sound beams inaudible to humans in the room.

"One of the most serious security issues related to the use of voice assistance systems is the lack of a rigorous mechanism to guarantee the trustworthiness of the voice source that operates the system," the researchers explain by way of introduction. "As previous studies have demonstrated, voice assistance systems are vulnerable to 'inaudible voice command attacks.' Here, an attacker can issue voice commands to a voice assistance device unbeknownst to the device owner. For instance, if an attacker generates an inaudible voice command that adjusts the volume of the music player set in a car to its maximum, the driver may be surprised or momentarily distracted, thus increasing the likelihood of an accident.

"We propose a novel inaudible voice attack, named Audio Hotspot Attack, which leverages the physical phenomena. In this attack, attackers attempt to input directional sound to voice assistance systems. Directional sound is generated by using the non-linearity of ultrasonic waves in the air. When the modulated ultrasound passes through the air, which acts as a non-linear medium, the signal is demodulated into audible sound even if a demodulation circuit is not prepared. It is well known that the demodulated sound signals exhibit higher directivity than those emitted from a normal loudspeaker."

Using a parametric speaker, built using an array of ultrasound transducers, the team were able to successfully send voice commands to Amazon Echo and Google Home devices without human participants in the same room being able to hear them. The trick: The two directional ultrasound waves only create audible sound at the point where they cross, which is targeted at the smart speaker system under attack.

These researchers aren't the first to have found a way to remotely attack voice assistant systems inaudibly, however. Last month a team from the Universities of Electro-Communications in Tokyo (UEC Tokyo) Michigan demonstrated that MEMS microphones could be tricked into reacting to a pulsed laser light in the same way as audible sound in an attack dubbed Light Commands.

The team's research is available in an open access paper via the IEEE Xplore Digital Library, while more information can be found on IEEE Spectrum.