In a worrying cybersecurity breakthrough, researchers have successfully managed to activate voice-activated smart assistants remotely using a laser.
Millions of people around the world have a smart speaker or similar voice-activated digital assistant in their home, and some use them to hook up IoT devices from smart lightbulbs and thermostats to door locks. The past few years have shown the disturbing privacy implications of having a smart speaker in your home, with Amazon, Google, and Apple all confirming that they had let employees listen to recordings of people's homes.
Cybersecurity researchers Takeshi Sugawara and Kevin Fu have now provided another compelling reason to keep your home off the IoT grid by demonstrating that digital assistants can be hijacked remotely using a laser shone through the window. The team discovered that a laser could somehow make the microphone membranes on smart speakers and smartphones vibrate.
That trick allowed the researchers to produce a working system that could silently issue voice commands using light. They tested at a variety of laser intensities and distances, and with a range of consumer devices including the Amazon Echo, Google Home, Apple iPhone, and two Android phones. In one test, they successfully issued voice commands to a device inside a home through a window from a nearby building over 75m away.
This proof of concept cyber-attack could be carried out silently from a distance and could give an attacker access to anything your smartphone or smart device has access to. This could include opening garage doors, unlocking your home, ordering products online, and accessing or modifying a user's data.
Source: Wired UK
