Incident: Voice Command Hijacking via Radio Waves on Smartphones by Hackers

Published Date: 2015-10-14

Postmortem Analysis
Timeline 1. The software failure incident described in the article happened around the time the article was published, which was on 2015-10-14 [52546].
System 1. Siri and Google Now voice command systems [52546]
Responsible Organization 1. French researchers at ANSSI, a French government agency devoted to information security, were responsible for causing the software failure incident reported in the article [52546].
Impacted Organization 1. Smartphone users with microphone-enabled headphones or earbuds plugged into their devices were impacted by the software failure incident described in the article [52546].
Software Causes 1. Exploitation of electromagnetic waves to trigger voice commands on smartphones with Google Now or Siri enabled [52546].
Non-software Causes 1. The use of radio waves to silently trigger voice commands on smartphones with Google Now or Siri enabled, exploiting the headphones' cord as an antenna [52546].
Impacts 1. The software failure incident allowed hackers to remotely trigger voice commands on smartphones with Google Now or Siri enabled, potentially leading to unauthorized actions such as making calls, sending texts, eavesdropping, visiting malware sites, and sending spam and phishing messages [52546]. 2. The attack exploited electromagnetic waves to convert them into electrical signals that appeared to the phone's operating system as audio coming from the user's microphone, enabling hackers to control the device discreetly [52546]. 3. The incident highlighted the security risk posed by leaving voice command functions enabled on a phone's lock screen, as attackers could exploit this vulnerability to access sensitive information or hijack social media accounts [52546]. 4. The researchers recommended fixes such as better shielding on headphone cords, using an electromagnetic sensor in the phone to block the attack, allowing users to create custom "wake" words, or implementing voice recognition to block out strangers' commands as potential solutions to prevent similar attacks in the future [52546].
Preventions 1. Better shielding on headphone cords to force attackers to use a higher-power radio signal or an electromagnetic sensor in the phone to block the attack could have prevented the incident [52546]. 2. Implementing software fixes such as letting users create their own custom "wake" words that launch Siri or Google Now, or using voice recognition to block out strangers' commands could have also prevented the incident [52546].
Fixes 1. Better shielding on headphone cords to force attackers to use a higher-power radio signal or an electromagnetic sensor in the phone to block the attack [52546]. 2. Software fixes such as letting users create their own custom "wake" words that launch Siri or Google Now, or using voice recognition to block out strangers' commands [52546].
References 1. French researchers at ANSSI, a French government agency devoted to information security [52546] 2. José Lopes Esteves and Chaouki Kasmi, the two French researchers who conducted the hack [52546] 3. Vincent Strubel, the director of the research group at ANSSI [52546]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the hack using radio waves to trigger voice commands on smartphones has not been reported to have happened again within the same organization or with its products and services. Therefore, there is no information available about a similar incident occurring again at the same organization as reported in the articles. (b) The software failure incident related to the hack using radio waves to trigger voice commands on smartphones has not been reported to have happened again at other organizations or with their products and services. Therefore, there is no information available about a similar incident occurring at other organizations as reported in the articles.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. The incident occurred due to a vulnerability in the design of voice-command-capable devices like Android phones and iPhones that have Google Now or Siri enabled. French researchers demonstrated how they could silently trigger voice commands on these devices using radio waves transmitted through headphones' cords as antennas. This design flaw allowed hackers to remotely and discreetly issue commands to the devices, potentially leading to unauthorized actions like making calls, sending texts, visiting malware sites, and sending spam messages [52546]. (b) The software failure incident related to the operation phase is also highlighted in the article. The incident occurred due to the operation or misuse of the voice-command-capable devices by users. Specifically, leaving Siri or Google Now enabled on the phone's lock screen represented a security risk, as it allowed attackers to exploit the voice command features to access sensitive information or hijack social media accounts. Users not disabling the voice command functions from the lock screen could inadvertently expose their devices to potential attacks, emphasizing the importance of proper operation and security practices [52546].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily within the system. The failure occurred due to a vulnerability in the voice command feature of smartphones, specifically Siri and Google Now, that allowed hackers to exploit electromagnetic waves to remotely trigger voice commands on the devices. This vulnerability was present within the design and implementation of the voice command functionality, making it a failure originating from within the system itself [52546]. (b) outside_system: The software failure incident does not involve contributing factors that originate from outside the system. The attack described in the article relied on exploiting a vulnerability in the headphones' cord to convert electromagnetic waves into electrical signals that mimic audio from the user's microphone, allowing hackers to remotely control the device. The attack did not rely on external factors beyond the vulnerability present in the system itself [52546].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article is related to non-human actions. The failure occurred due to a clever hack that used radio waves to silently trigger voice commands on smartphones with Google Now or Siri enabled, exploiting the headphones' cord as an antenna to convert electromagnetic waves into electrical signals that appear to be audio coming from the user's microphone [52546]. The attack was demonstrated by researchers who were able to remotely and discreetly control smartphones through electromagnetic waves without the need for human interaction [52546]. (b) The software failure incident was not directly caused by human actions but rather by the vulnerability in the voice command systems of smartphones that allowed for exploitation through radio waves. However, the researchers did recommend fixes such as better shielding on headphone cords or implementing custom wake words to prevent such attacks, which could be considered human actions to mitigate the vulnerability [52546].
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the article is related to hardware. The incident involves a hack that exploits the hardware components of smartphones, specifically the headphones' cord as an antenna to convert electromagnetic waves into electrical signals that trick the phone's operating system into executing voice commands without the user's knowledge [52546]. (b) The software failure incident is also related to software. The hack demonstrated in the article targets voice-command-capable devices like smartphones with Google Now or Siri enabled, exploiting vulnerabilities in the software that allow remote and discreet execution of voice commands through electromagnetic waves [52546].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. The incident involves a hack where French researchers demonstrated how they could silently trigger voice commands on smartphones using radio waves, exploiting headphone cords as antennas to remotely control devices without the users' knowledge or consent [52546]. The attack could be used to make calls, send texts, eavesdrop, redirect browsers to malware sites, and send spam and phishing messages, all without the user speaking a word. The researchers highlighted the critical security impacts of inducing parasitic signals on voice-command-capable devices through electromagnetic waves, emphasizing the potential for remote and discreet manipulation of devices [52546]. (b) The software failure incident is non-malicious in the sense that it is not caused by unintentional errors or faults in the software itself. Instead, the incident is a result of a deliberate hack orchestrated by the researchers to demonstrate vulnerabilities in voice-command-capable devices and the potential risks associated with electromagnetic wave manipulation. The attack was designed to exploit the design and functionality of the devices, rather than being a result of accidental software flaws or bugs [52546].
Intent (Poor/Accidental Decisions) accidental_decisions The intent of the software failure incident described in the articles is related to "accidental_decisions." The incident involved a clever hack by French researchers who accidentally discovered a way to silently trigger voice commands on smartphones using radio waves transmitted through headphone cords [52546]. The researchers did not intend to exploit this vulnerability but rather discovered it as a result of their experimentation with electromagnetic waves and headphone cords.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the article can be attributed to development incompetence as it was caused by a clever hack that exploited a vulnerability in voice-command-capable devices. The French researchers were able to silently trigger voice commands on Android phones and iPhones by using radio waves transmitted through headphones' cords as antennas. This hack allowed hackers to remotely and discreetly control the devices, making calls, sending texts, visiting malware sites, and sending spam and phishing messages without the user's knowledge [52546]. (b) The software failure incident can also be considered accidental as it was not a deliberate action by the users but rather a vulnerability that was discovered and exploited by the researchers. The attack was carried out using relatively simple equipment like a laptop running open-source software, a software-defined radio, an amplifier, and an antenna. The attack was not dependent on user interaction but rather on the vulnerability present in the voice-command-capable devices [52546].
Duration permanent (a) The software failure incident described in the article is more of a permanent nature. The vulnerability exploited by the French researchers using radio waves to silently trigger voice commands on smartphones with Google Now or Siri enabled is a fundamental flaw in the design of the voice command systems. The attack method demonstrated by the researchers could potentially allow hackers to remotely and discreetly control smartphones, make calls, send texts, visit malware sites, and more, without the user's knowledge [52546]. This type of vulnerability is not easily mitigated and requires significant changes to the underlying design and implementation of the voice command systems to address effectively.
Behaviour value, other (a) crash: The articles do not mention any instances of a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident described in the articles does not involve the system omitting to perform its intended functions at an instance(s). (c) timing: The incident does not relate to the system performing its intended functions correctly but too late or too early. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The incident involves a hack that allows a hacker to silently trigger voice commands on smartphones, leading to unauthorized actions such as making calls, sending texts, visiting malware sites, and sending spam and phishing messages [52546]. (e) byzantine: The software failure incident does not exhibit the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident can be categorized as unauthorized remote control or manipulation of smartphone voice command features through a radio wave attack, exploiting headphone cords as antennas to transmit electromagnetic waves that mimic audio signals, enabling the hacker to issue commands to the device without the user's knowledge or consent [52546].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [52546]. (b) harm: The article does not mention any physical harm caused to people due to the software failure incident [52546]. (c) basic: The incident did not impact people's access to food or shelter [52546]. (d) property: People's material goods, money, or data were potentially impacted by the software failure incident. The attack allowed hackers to remotely trigger voice commands on smartphones, leading to potential risks such as making calls, sending texts, visiting malware sites, and sending spam and phishing messages [52546]. (e) delay: There is no mention of people having to postpone an activity due to the software failure incident in the provided article [52546]. (f) non-human: Non-human entities were impacted by the software failure incident. The attack targeted smartphones with voice-command capabilities, exploiting vulnerabilities in the devices' voice recognition systems [52546]. (g) no_consequence: The article does not state that there were no real observed consequences of the software failure incident [52546]. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident that did not occur, such as the ability for a hacker to hide a radio device in a crowded area and transmit voice commands to vulnerable smartphones, potentially causing them to call paid numbers and generate cash [52546]. (i) other: The article does not mention any other specific consequences of the software failure incident beyond those discussed in options (a) to (h) [52546].
Domain information The software failure incident described in the articles is related to the industry of information [52546]. The incident involves a security vulnerability in voice-command-capable devices like smartphones, specifically targeting voice assistants such as Siri and Google Now. The vulnerability allowed hackers to remotely and discreetly issue voice commands to the devices using electromagnetic waves transmitted through headphones with microphones plugged into the devices. This incident highlights the security risks associated with leaving voice command functions enabled on smartphones, particularly from the lock screen, and emphasizes the importance of implementing security measures to mitigate such risks.

Sources

Back to List