High-tech crooks could hack your voice assistant with ‘ultrasonic commands’ you can’t hear

Hackers could give voice commands to your devices without you being able to hear them, according to a recent research paper on what scientists dubbed SurfingAttack.

The attack can target smartphones that are placed on a solid surface, such as a tabletop, by sending ultrasonic voice commands to the device through the surface from a hidden transmitter. The commands would be out of the range of human hearing but could be heard and understood by voice assistant software on the phones.

The researchers—from Michigan State University, China’s Songshan Lake Materials Laboratory, the University of Nebraska-Lincoln, and Washington University in St. Louis—tested the hacking technique on a number of iPhones and Android phones, finding the devices successfully responded to the secret commands. By lowering the phones’ volume to the lowest nonmuted level, the researchers could even pick up the phones’ responses, potentially without users hearing them. That could be used for things like having a phone read out an incoming text message containing a security code, or even carrying on phone conversations with a victim’s contacts, they say.

The technique, which used a $5 component to generate the ultrasonic signals, didn’t work on vertical voice assistant devices like the Amazon Echo and Google Home, the researchers found, though they suggested that a stronger amplifier might enable the ultrasound signals to reach those devices through a table as well.

To reduce the effectiveness of the SurfingAttack, device makers could use physical or software techniques to filter out ultrasonic commands, the researchers suggest. Another, more immediate option is to keep the device on a “soft woven fabric” rather than directly on a hard surface.

Previous research has studied adding noise to audio that isn’t recognizable by humans as speech but that voice assistants interpret as commands.