Smartphone can be hacked by ultrasonic waves

Smartphones can be activated with virtual assistants (Google Assistant or Apple Siri) remotely using ultrasound to automatically perform various actions such as making calls, reading messages, taking photos, etc.

The team at the University of Washington (USA) carried out the attack with only an ultrasound device connected to a computer running software called Surfing Attack to issue orders.

According to the researchers, ultrasonic waves can be transmitted across a table made of metal, wood or glass. This means that if you put your smartphone on a table or similar surface made of this material, it is at risk of being hacked. The ability to transmit ultrasonic waves of a plastic table top is poor, making it harder to attack.

Smartphone can be hacked by ultrasonic waves Picture 1

To make the attack, researchers first attach a microphone (to hear the feedback of the virtual assistant) and a voltage probe to the table. They then use a computer running Surfing Attack to activate the ultrasonic generator and order the virtual assistant. At that time, the Assistant or Siri will recognize the command and follow it yourself.

In the video below, the hacked Android-enabled smartphone can automatically activate Assistant to make calls, take selfies, retrieve passwords in SMS, read aloud SMS and adjust the volume automatically.

The researchers tested the same scenario attacks with 17 phones from four manufacturers, including Motorola G5, Motorola Z4, Pixel 1, Pixel 2 and Pixel 3, Samsung Galaxy S7, Galaxy S9, iPhone 5, 5s, 6 Plus and iPhone X, Xiaomi Mi5, Mi8, Mi8 Lite. The results showed that only Huawei Mate 9 and Galaxy Note10 + were unsuccessful. According to the researchers, the reason may be due to the curved design of the back of the machine makes the contact area between the machine and the table reduces, thereby reducing the likelihood of being attacked.

Researchers recommend that users should use a thick case, do not put the phone in direct contact with the surface and turn off the virtual assistant activation feature on the lock screen to avoid the risk of being attacked by Surfing Attack .