Hidden audio is simply too easy. Hidden audio is the knife that kills desire for any financial services access through a voice assistant - for those smart enough to not follow the horde.
Alexa and Siri Can Hear Hidden Commands
11–20 of 178 posts
Re: Alexa and Siri Can Hear Hidden Commands
#12I can't get Siri to turn on the flashlight or lock my phone. What can Siri do that's dangerous?
Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.
Re: Alexa and Siri Can Hear Hidden Commands
#13Serious off-topic question:
Are there docs for Siri so that i can learn what it can/can’t do?
I have tried skipping songs, playing a genre, set random play, and similar in iTunes — generally a failure, often initiates an unwanted phone call.
On the phone I can successfully call the intended contact about 50% of the time, possibly because I have ~250 contacts.
I suspect that if i knew the right words to interact with the API I could have a more enjoyable Siri experience.
Alternatively, is there a way to disable it completely — as in long hold on headphones button does not initiate.
Re: Alexa and Siri Can Hear Hidden Commands
#14I can't get Siri to turn on the flashlight or lock my phone. What can Siri do that's dangerous?
Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.
I guess you could tell Siri,
> Send an email to my mom that says, "I have an emergency and I need $2000. Here's the account number to send it to: 12345. Mom, please don't ask questions. This is urgent. Send the money now."
Would Siri lookup your mom's email and send that?
Re: Alexa and Siri Can Hear Hidden Commands
#15I hadn't thought of this, it's quite concerning. I don't see how they can safeguard against this without reducing the effectiveness of the voice recognition. A secret command to "paste clipboard into new email, send to [address]" is a shiny new attack vector without any apparent straight forward way to plug the security hole.
The obvious plug would be to not allow such a ridiculously unsafe command without requiring you to unlock your device, much like my iPhone does today.
Sure, but your phone is sometimes already unlocked because you used it 30 seconds ago and it now sits on the table. Or it's playing music, or your kid has it etc. I don't think I was thinking about a phone anyway, more the dedicated devices that sit there listening all the time.
Re: Alexa and Siri Can Hear Hidden Commands
#16Earlier quoted context omitted.
Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.
I guess you could tell Siri, > Send an email to my mom that says, "I have an emergency and I need $2000. Here's the account number to send it to: 12345. Mom, please don't ask questions. This is urgent. Send the money now." Would Siri lookup your mom's email and send that?
I have no idea, but a "smarter" email would be "mum can I borrow $100, pay you back ASAP, just a bit short today sorry and thanks!"... Mum would be less inclined to phone you in a panic.
Re: Alexa and Siri Can Hear Hidden Commands
#17I can't get Siri to turn on the flashlight or lock my phone. What can Siri do that's dangerous?
Well, it can read your schedule, tell you your location and then there is the homekit stuff. It could potentially disable certain security features you might have installed at your house, it could possible perform a very expensive modification to your HVAC configuration, in an extreme case that could maybe be fatal (disable heating in the winter at an older person's home or something like that.) It can also read your messages which are used for MFA in some situations. My wife and I have our accounts hooked together and I can ask Siri where she is and it uses find my friends, it can also kick off find my iPhone which shows my wife's presumed location on a map.
I think it can do Apple Pay actions too.
Degrees of dangerous. I don't have a homepod but presumably it couldn't do anything with Apple pay or your messages. Having Alexa or Siri control home automation stuff seems like something you might want to think about a little, leaving the lights on all day and burning some energy is a very different thing than re-configuring your HVAC or a security camera.
Re: Alexa and Siri Can Hear Hidden Commands
#18Just out of curiosity, what's the frequency range that a typical mic can pick up the signal from? The article did not specially mention about the range instead it said inaudible.
And here is another article I found that mentions the normal 20-20kHz frequency response range: http://blog.shure.com/mic-basics-frequency-response/
Isn't that mostly overlap with the human ear capability? I understand each person is different, etc. But just curious the specifics.
Re: Alexa and Siri Can Hear Hidden Commands
#19Serious off-topic question: Are there docs for Siri so that i can learn what it can/can’t do? I have tried skipping songs, playing a genre, set random play, and similar in iTunes — generally a failure, often initiates an unwanted phone call. On the phone I can successfully call the intended contact about 50% of the time, possibly because I have ~250 contacts. I suspect that if i knew the right words to interact with…
This doesn't address your question but might be interesting. As someone who has used Android forever and never tried Siri, those anecdotes are mind blowing to me. For me with Google Assistant, media commands work about 80% and successful call initiation is about 90%. And I haven't looked for documentation either. YMMV of course.
Re: Alexa and Siri Can Hear Hidden Commands
#20Earlier quoted context omitted.
Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.
I guess you could tell Siri, > Send an email to my mom that says, "I have an emergency and I need $2000. Here's the account number to send it to: 12345. Mom, please don't ask questions. This is urgent. Send the money now." Would Siri lookup your mom's email and send that?
Yes, Siri knows family