{"id":6771,"date":"2023-08-07T15:00:00","date_gmt":"2023-08-07T12:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=6771"},"modified":"2023-11-24T18:06:55","modified_gmt":"2023-11-24T16:06:55","slug":"hear-no-evil-ultrasound-attacks-on-voice-assistants","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2023\/08\/07\/hear-no-evil-ultrasound-attacks-on-voice-assistants\/","title":{"rendered":"Hear no evil: Ultrasound attacks on voice assistants"},"content":{"rendered":"\n

Regular WeLiveSecurity readers won\u2019t be stunned to read that cyberattacks and their methods keep evolving as bad actors continue to enhance their repertoire. It\u2019s also become a common refrain that as security vulnerabilities are found and patched (alas, sometimes after being exploited<\/a>), malicious actors find new chinks in the software armor.<\/p>\n\n\n\n

Sometimes, however, it is not \u201cjust\u201d a(nother) security loophole that makes the headlines, but a new form of attack. This was also the case recently with a rather unconventional attack method dubbed NUIT. The good news? NUIT was unearthed by academics and there are no reports of anybody exploiting it for pranks or outright cybercrime. That said, it doesn\u2019t hurt to be aware of another way your privacy and security could be at risk \u2013 as well as about the fact that NUIT can actually come in two forms.<\/p>\n\n\n\n

How NUIT saw the light of day<\/h2>\n\n\n\n

NUIT, or Near-Ultrasound Inaudible Trojan<\/a>, is a class of attack that could be deployed to launch silent and remote takeovers of devices that use or are powered by voice assistants such as Siri, Google Assistant, Cortana, and Amazon Alexa. As a result, any device accepting voice commands \u2013 think your phone, tablet or smart speaker \u2013 could be open season. Ultimately, the attack could have some dire consequences, ranging from a breach of privacy and loss of trust to even the compromise of a company\u2019s infrastructure, which could, in turn, result in hefty monetary losses. <\/p>\n\n\n\n

Described by a team of researchers<\/a> at the University of Texas in San Antonio (UTSA) and the University of Colorado Colorado Springs (UCCS), NUIT is possible because microphones in digital assistants can respond to near-ultrasound waves played from a speaker. While inaudible to you, this sound command would prompt the always-on voice assistant to perform an action \u2013 let\u2019s say, turn off an alarm, or open the front door secured by a smart lock. <\/p>\n\n\n\n

To be sure, NUIT isn\u2019t the first acoustic attack to have made waves over the years. Previously, attacks with similarly intriguing names have been described \u2013 think SurfingAttack<\/a>, DolphinAttack<\/a>, LipRead<\/a> and SlickLogin<\/a>, including some other inaudible attacks that that, too, targeted smart-home assistants.<\/p>\n\n\n\n

Night, night<\/h2>\n\n\n\n

As mentioned, NUIT comes in two forms: They are:<\/p>\n\n\n\n