Like many other technological achievements, digital assistants were created to make people’s daily lives easier. However, as has become known recently, the privacy of users of such devices was questioned when it was revealed that companies were listening to their interactions with them. And as if that were not enough, there are also malicious actors who are always on the lookout to influence these devices. The latest addition to the ways to exploit a digital assistant is “Light Commands”. A team of researchers managed to fool digital assistants by sending a specially crafted laser beam to various popular devices, such as Google Home, Amazon Echo, iPhone XR, Google Pixel 2, Facebook Portal Mini, etc.
The researchers found that “by modulating an electrical signal to the intensity of a light beam, attackers can trick microphones into producing electrical signals as if they were receiving genuine audio.” This in turn allows the researchers to send almost any command they like to the devices.
This system exploits a vulnerability that exists in the MEMS microphones in many devices that these assistants use to recognize voice commands.
Until now, most of us know that microphones are sensitive to sound waves. But as researchers explain, under the right conditions, they can also respond to light.
While targeting an assistant via laser is a difficult process, an aspiring hacker could do it from a distance of 115 meters from a house window.
It should be noted that the voice recognition feature, which identifies a user by their voice, was disabled during Light Command's testing. However, according to the researchers, assistants check the wake-up phrase (such as "Ok, Google" or "Alexa") to identify a person's voice, not the entire command. So the attack is still possible.
Also, the entire set of Light Commands settings costs about $600, which means it is not that easy for anyone to acquire it.
To protect yourself from such an attack, you should be careful with device , as you won't hear anything strange. However, you may notice a light shining on it, or the device turning on by itself.
The researchers published their findings in a new research paper. They have also proposed some mitigation techniques. For example, using devices that can reduce the amount of light reaching the microphones or using sensor fusion techniques to obtain sound from multiple microphones, since the laser light will be able to target only one.
