Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rigged YouTube videos can use Siri and Google Now to hijack your phone

nakedsecurity.sophos.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#11

Post by tgayton »

yeukhon wrote: post #6
sparky_z wrote: post #3

Do phones not filter out/ignore any sound being emitted from the speaker? Seems like that shouldn't be too hard to do.

Can you really distinguish sound emitted from the speaker from someone with a hoarse voice? Furthermore, what about medium? Traveling different medium should be considered.

It's definitely possible from a technical perspective. It's very similar to the way echo cancellation works on phones already.

Since the output is known, similar input can then be stripped. This only works when both the output of the speaker and input of the microphone are known.

This can't be done to determine whether another speaker, such as a TV, generated the output.

Visual aid on echo cancellation: http://i.imgur.com/m2LSIz9.png

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#13

Post by eknkc »

yeukhon wrote: post #6
sparky_z wrote: post #3

Do phones not filter out/ignore any sound being emitted from the speaker? Seems like that shouldn't be too hard to do.

Can you really distinguish sound emitted from the speaker from someone with a hoarse voice? Furthermore, what about medium? Traveling different medium should be considered.

I'm completely making this up;

I'd guess most speaker generated audio would be from a compressed source. Audio compression generally cuts off frequencies that we can not hear. When we speak though, we must be generating a lot of inaudible frequencies. It could be determined by checking if those exist or not.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#14

Post by r00fus »

bydo wrote: post #12
shahzeb wrote: post #4

At least on the iPhone, Siri is only activated by the "Hey Siri" command if your phone is plugged in to charge.

Only on older hardware. Anything with an A9/M9 (iPhones 6S and SE, iPads Pro) works on battery power as well.

I got around this on my iPhone6 using a battery case :) Nowadays, I just leave it off, though.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#16

Post by Vexs »

goda90 wrote: post #8
sparky_z wrote: post #3

Do phones not filter out/ignore any sound being emitted from the speaker? Seems like that shouldn't be too hard to do.

Wouldn't that be similar to the tech that removes echoing from voice/video chatting when someone isn't using headphones? I wonder how intense that kind of processing is.

You can do it trivially with a bit of hardware, no processing needed.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#17

Post by Vexs »

yeukhon wrote: post #9

Do people find Sri and Google Now actually useful? I hardly ever find a use case for it, even when I am driving. I just think people should disable Sri and Google Now by default, and only activate after pressing a button.

I find it useful for quick conversions, finding my phone in a dark room, and it's often easier than scrolling through my contact book.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#18

Post by sparky_z »

yeukhon wrote: post #6
sparky_z wrote: post #3

Do phones not filter out/ignore any sound being emitted from the speaker? Seems like that shouldn't be too hard to do.

Can you really distinguish sound emitted from the speaker from someone with a hoarse voice? Furthermore, what about medium? Traveling different medium should be considered.

Well, the device knows exactly what signal it's putting out through the speaker, so it can predict what the microphone will pick up. It doesn't know what someone with a hoarse voice is about to say.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#19

Post by superuser2 »

I don't understand why anyone would leave "Hey Siri" turned on. I do use Siri occasionally, but no result of any Siri query is of any value to me while my phone is in my pocket. If I'm going to take it out of my pocket anyway, there's no additional friction in pressing the home button.

Re: Rigged YouTube videos can use Siri and Google Now to hijack your phone

#20

Post by vitd »

yeukhon wrote: post #9

Do people find Sri and Google Now actually useful? I hardly ever find a use case for it, even when I am driving. I just think people should disable Sri and Google Now by default, and only activate after pressing a button.

Yes, I personally find Siri very useful. I almost always interact with Siri through my watch and I do things like start a cooking timer while my hands are covered in raw chicken juice, set a reminder to do something tomorrow, or reply to a text via voice while driving.
Post reply on HN