Gaining root access on Alexa using only sound [pdf]

#1

Post by jaspergilley » Tue, Nov 17, 2020, 12:13 AM UTC

Gaining root access on Alexa using only sound [pdf]
usenix.org

Re: Gaining root access on Alexa using only sound [pdf]

#2

Post by peterburkimsher » Tue, Nov 17, 2020, 2:36 AM UTC

Please change the title to the actual paper: "Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems"

The paper is about sending voice commands using lasers, not sound. There's also no mention of "root access", the paper is just about replaying audio-converted-to-light rather than having any kind of interactive "root" shell prompt. The only feedback to know whether the exploit succeeded would be sending commands (e.g. unlock a door), which the victim might notice.

Re: Gaining root access on Alexa using only sound [pdf]

#3

Post by weerd » Tue, Nov 17, 2020, 3:46 AM UTC

"we show how to use light to obtain control over these devices at distances up to 110 meters"

"Command Selection: ...Purchase a Laser Pointer"

Hilarious example

Making other people buy stuff with laser beams... wait until marketing finds out!

Re: Gaining root access on Alexa using only sound [pdf]

#4

Post by ericpauley » Tue, Nov 17, 2020, 4:14 AM UTC

peterburkimsher wrote: post #2

Please change the title to the actual paper: "Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems" The paper is about sending voice commands using lasers, not sound. There's also no mention of "root access", the paper is just about replaying audio-converted-to-light rather than having any kind of interactive "root" shell prompt. The only feedback to know whether the exploit succeeded wou…

Agreed, this title is amazingly inaccurate.

Re: Gaining root access on Alexa using only sound [pdf]

#5

Post by bigyikes » Tue, Nov 17, 2020, 5:51 AM UTC

Smarter Every Day has a video demonstrating this technique[1] with the help of one of the researchers involved in this project. I was a little spooked at first, but then I realized that there is no way to point a laser at any of my devices.

[1]: https://www.youtube.com/watch?v=ozIKwGt38LQ

Re: Gaining root access on Alexa using only sound [pdf]

#6

Post by yftsui » Tue, Nov 17, 2020, 6:28 AM UTC

peterburkimsher wrote: post #2

Please change the title to the actual paper: "Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems" The paper is about sending voice commands using lasers, not sound. There's also no mention of "root access", the paper is just about replaying audio-converted-to-light rather than having any kind of interactive "root" shell prompt. The only feedback to know whether the exploit succeeded wou…

Agreed, it has nothing new beside the YouTube video demoed a few months ago by exploiting MEMS microphone on voice assistants. The pictures in the paper is hilarious, an oscilloscope showing two Sin waves from the internal calibration source, seriously?