Ultrasonic attacks wreak havoc on voice assistants

A new type of attack is brewing in the tech industry: NUIT, or ultrasonic attack, inaudible near-ultrasonic Trojans that can exploit vulnerabilities in microphone-equipped IoT devices and voice assistants such as Apple Siri, Google Assistant And Microsoft Cortana. The attacks are not audible to humans, but they can effectively turn smart devices into potentially malicious devices.

However, for now, the viruses have been created by researchers at the University of Texas at San Antonio and the University of Colorado and will be demonstrated at the upcoming 32nd USENIX Security Symposium, which will be held August 9-11 in Anaheim, California. The research team provided The Register with a preliminary demo showing two separate attacks: NUIT-1 and NUIT-2.

The former sends near-ultrasonic signals to a smart speaker to turn on the microphone and voice assistant on the same device. The second uses the victim’s speaker to attack the microphone and voice assistant on another device.

NUIT attacks work by converting voice commands into near-ultrasonic signals that the human ear cannot detect but voice assistants can.

The researchers were able to control the volume of the iPhone with a silent command of less than 77ms (“six percent of conversations”) to reduce the volume of the smartphone to 6%. The second silent instruction (“open the door”) allowed them to use Siri to open the victim’s front door via the Apple Home app.

The NUIT-2 attack sends embedded ultrasonic signals through a teleconference such as a Zoom meeting. This vector allows hackers to use a nearby phone remotely. NUIT-2 attacks do not have a 77ms time window, allowing researchers to test more complex commands.