Researchers hack Siri from 16 feet away

http://www.businessinsider.com/siri-silently-hacked-from-16-feet-away-by-french-researchers-2015-10

by dosapati • 11 years ago

42 18 11 years ago

ChuckMcM• 11 years ago

Interesting inducing audio on the wire of a connected pair of headphones. (lousy shielding, coax wouldn't work but nobody seems to have coax headphone cables at the low end :-)

I've always wondered what would happen if broadcast "Ok Google, call 555-1212, ok" over a loudspeaker in a crowded shopping mall. How many people's phones would simply obey?

dkokelley4• 11 years ago

I've found that my iPhone does a fairly decent job of discerning my voice in a noisy environment. I suspect that there is lots of clever use of noise cancelling mics to distinguish between a nearby voice issuing commands (mine), and noise in the environment.

It would be an interesting experiment.

egeozcan• 11 years ago

Wasn't there actually a radio ad which just did that?

edit: found it http://www.cultofmac.com/328705/toyota-radio-ad-shuts-down-i...

fuzzywalrus2• 11 years ago

There's a few things that seem key to this: Leaving "hey siri" and "ok google" on at all times, requires relatively noise free environment. Also, with the always on feature, you need to properly address one's phone. Simply changing Siri to "Stupidhead" would render the always on attack moot.

It's interesting but without direct access, there's only minimal information to be gleaned as commanding Siri to look up the most recent call would only allow the attack to see the most recent call with a direct LOS.

Also, this recap can be skipped by going to the original wired article: http://www.wired.com/2015/10/this-radio-trick-silently-hacks...

PerryCox• 11 years ago

Siri can't be renamed to stupidhead or anything else for that matter, but the always listening feature can be disabled.

fuzzywalrus2• 11 years ago

I stand corrected, I assumed that you could as you can rename what Siri calls you. Learn something new every day.

dkokelley4• 11 years ago

As presented, people are only vulnerable if they:

- Allow Siri from the lock screen

- Have headphones plugged in (presumably Apple's)

- Are not using their device or have their headphones in (otherwise the attack would be detected immediately) OR:

- Have audible feedback from Siri disabled

P.S. Link to source article: http://www.wired.com/2015/10/this-radio-trick-silently-hacks...

Original research publication: http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=tru...

TazeTSchnitzel• 11 years ago

- Allow Siri from the lock screen

Lots of people use 'Hey Siri', myself included.

- Have headphones plugged in (presumably Apple's)

Not that unlikely.

- Are not using their device or have their headphones in (otherwise the attack would be detected immediately) OR:
- Have audible feedback from Siri disabled

These would be the killers. The moment Siri's activated you'd hear it loudly in your ears.

dkokelley4• 11 years ago

Does "Hey Siri" work when unpugged? My 30 seconds of Google seemed to show that it needed to be plugged in.

Laaw• 11 years ago

So what? You know your phone visited a website, but if that site had a zero-day, would it matter?

biot2• 11 years ago

A few weeks ago I was in a meeting and Siri blurted out "Sorry I didn't get that". I've never had "hey Siri" activated (I immediately verified) and nothing was plugged into my iPhone 5. Rather disconcerting.

prawn• 11 years ago

It will activate if you hold down the home button, something that can easily happen accidentally when your phone is in your pocket or otherwise squashed against something.

Mine activated the other day in that manner and my three year old looked around wildly, then said "Was that the robot lady?!"

biot2• 11 years ago

It was sitting face-up on a table. Other than the possibility of a flaky home button, I'm chalking this one up to the NSA. :)

asifjamil• 11 years ago

Happens to me quite often if I accidentally have something in my pocket which presses down the Home button of the iPhone for a few seconds.

orahlu• 11 years ago

This was presented at SSTIC 2015.

paper (in french): https://www.sstic.org/media/SSTIC2015/SSTIC-actes/injection_... video (in french): http://static.sstic.org/videos2015/SSTIC_2015-06-03_P09_AGRE...

Researchers hack Siri from 16 feet away

Related Stories