Researchers hide inaudible commands in YouTube videos to hijack voice assistants
Silent tones in audio streams can secretly trigger Siri, Alexa, and Google Assistant without user awareness.
Deep Dive
Key Points
- Attackers embed ultrasonic or modulated commands in YouTube videos, podcasts, and music that are inaudible to humans.
- Voice assistants like Siri, Alexa, and Google Assistant treat the hidden commands as legitimate user requests.
- Potential actions include unauthorized calls, purchases, and opening malicious URLs without user awareness.
Why It Matters
This attack undermines trust in always-listening devices, threatening billions of voice assistants in homes and offices.