back to article Drowning Dalek commands Siri in voice-rec hack attack

University boffins have brewed one of the most complex mechanisms for loading malware onto phones by way of surreptitious Google Now and Siri voice commands hidden in YouTube videos. For the attack to work, phones need to be in a state where they can receive voice commands - a feature often left unlocked - and close enough to …

  1. Slx

    If you leave your mobile accessible by voice commands without any kind of authentication, you'll always have issues.

    Even just to changing the trigger phrase to something other than OK Google or Hey Siri! Should be enough to avoid issues.

    1. Cirdan

      Alternate trigger phrase... Star Trek style

      Mine is "Oh, computer" said in Star Trek "Scotty" accent with rolled Rs. No rolled Rs, no access.

      Unless you use the keyboard.

      How quaint!

      ... Cirdan...

  2. Real Ale is Best

    I tried the video with my Andriod

    Even setting the phone to listen for voice commands, it didn't recognise a single word.

    Maybe the latest Android is better at resisting this?

    1. Bloakey1

      Re: I tried the video with my Andriod

      It doesn't work on Andriod but it does with Android.

      1. Shades

        Re: I tried the video with my Andriod

        "It doesn't work on Andriod but it does with Android."

        Thats cleared that up then.

    2. Alan Edwards

      Re: I tried the video with my Andriod

      Me either. DIdn't work at all on a Galaxy S7, even sat at the voice command screen in the Google app. My voice will wake it up from the home screen.

      Maybe desktop speakers or the audio encoding on YouTube mangles the sound too much?

  3. Bloakey1

    Ahhh. Well my phone does not have "Automatic Woyce Weckognition".

    1. Kane

      "Ahhh. Well my phone does not have "Automatic Woyce Weckognition"."

      "Siwi, can you wecommend a westauwant?"

      1. Valeyard

        "authorisation code wictor wictor.."

    2. JimmyPage Silver badge

      Ahhh. Well my phone does not have "Automatic Woyce Weckognition".

      Welease Woderick

      1. Groaning Ninny

        Re: Ahhh. Well my phone does not have "Automatic Woyce Weckognition".

        I was just thinking of the prince/monster from Willo the Wisp:

      2. Joe H.

        Re: Ahhh. Well my phone does not have "Automatic Woyce Weckognition".

        Welease Weginald!

    3. Mark 85

      Obwiously no wasscally wabbits either.

    4. Chris King

      "SIri, where do they keep the nuclear wessels ?"

  4. 2460 Something

    Interesting premise, getting it to open a compromised website not too much of a stretch. Changing voice activation commands a good start. Shame they never work quite as well as the default ones though.

  5. Anonymous Coward

    drowning dalek ?

    Sounds more like The Borg...

    1. Valeyard

      Re: drowning dalek ?

      that was my first thought too

      apparently my phone is immune to attack because the damn thing never works for me unless i do a cockney accent (normal accent is northern irish)

      1. Stevey

        Re: drowning dalek ?

        That happens for me too ( somewhat modified north-east accent ), unless I do my best Dick van Dyke impression, especially with the sat nav.

        It's made more annoying because it recognises my wifes' ( quite strong ) West African accent with no problems at all

    2. This post has been deleted by its author

    3. Darryl

      Re: drowning dalek ?

      Siri, you will open Resistance is futile

    4. Chris King

      Re: drowning dalek ?

      "Sounds more like The Borg...

      "We are the Borg. Lower your shields and surrender your ships. We will add your biological and technological distinctiveness to our own. Your culture will adapt to service us. Resistance is futile."

      "Hang on lads, it's a Windows Phone !"

      "Bugger. Nothing worth pinching from these Humans then".

  6. Shades
    Paris Hilton

    That last command...

    ...was it in Klingon?

    1. TRT Silver badge

      Re: That last command...

      Daleks will change their voice synthesiser to match the local language... So perhaps they are attacking a Klingon colony.

      1. Chris King

        Re: That last command...

        But "EXTERMINIEREN !" is not even a real German word - they should have been screaming "VERNICHTEN !"

        Of course, they didn't quite get the voices right in the 80's

        1. styx-tdo

          Re: That last command...

          so close.. if Duden has it, it is german by definition ;)

          -> outdated word, but valid.

  7. PNGuinn

    Drowning dalek

    So - Siri's really a drowning dalek.

    Who'da guessed?

    Now all we have to do is identify Tay.

  8. DwarfPants

    Techno Anyone

    It sounds like you could happily include it in a techno track and it would not sound out of place. Now to get my brand of techno in to the play list for a public place, a railway station for example. No wait, announcers already sound like this, may be someone has beaten me to it. Another plan for world domination thwarted.

  9. JimmyPage Silver badge

    Worried the beeps might give it away ..

    There are so many apps which insist on beeping, buzzing and generally shouting HERE I AM that if you had your sound on, you'd never spot the signal.

    Once again, signal-to-noise ratio, guys.

  10. JimmyPage Silver badge

    Hang on a second

    Not doubting the article, but it has just triggered a vague memory of some sort of scare ?? marketing ploy ?? to do with kids toys.

    1980s ???

    Wasn't there a kids toy robot thingy which "reacted" to audio codes in the (cunningly linked) TV cartoon ?

    Or have I just given some startup an idea ?

    1. Mage Silver badge

      Re: Hang on a second

      "Wasn't there a kids toy robot thingy which "reacted" to audio codes in the (cunningly linked) TV cartoon ?"

      It's called a smartphone.

      They can embed signals within the passband of digital audio on TV that are too high frequency for most adults to hear.

      Some Apps have the code to call the "mothership" so they know what you are watching. MUCH easier than voice recognition. Possibly Facebook App, it uses the microphone?

      WiFi Barbie is a little scarier on the level of "Teddy always knows best" or whatever the Harry Harrison story was.

      Phones (and some car radios) USED to have local voice recognition. Now it seems (on Android, Amazon Echo, Windows Phone and iOS) to be so called "cloud based". I have data mode on Mobile always disabled (to save money and for privacy) and wifi off by default (to save battery)

      1. Dieter Haussmann

        Re: Hang on a second

        Reminds me of the masks on

        have a happy halloween from silver shamrock.

  11. PhilErrington

    Judas Priest were obvously doing this in 1985

    Now we know what Judus Priest were setting up in 1985.

    Such evil brummie visionaries.

    see comment at 14:12 on video.

  12. Anonymous South African Coward Bronze badge

    control by fart

    will that be an option, to be able to control your phone by the sound of released air biscuits?

    1. Anonymous Coward
      Anonymous Coward

      Re: control by fart

      don't talk shit

    2. Chris King
  13. TheProf

    Drowning Dalek?

    I could understand the words being spoken so I wonder why they bothered obfuscating them. The demo with the background noise didn't mask the words either as they were played MUCH LOUDER than the background burble. Let's see a demo that works in a busy pub on a Friday night.

    I'm more worries about Radio 4 taking control of my phone. I'm sure John Humphrys never says 'OK Google' or 'Hey Cortana' at 7:45am but the Today programme keeps waking my phone(s) up.

    1. Michael H.F. Wilkinson Silver badge

      Re: Drowning Dalek?

      Apparently I can also understand drowning Dalek. Odd that. I never felt like exterminating the doctor. I was always quite fond of him (certainly as played by Tom Baker, the only version I remember seeing on Dutch TV).

  14. lukewarmdog

    The end of everything

    This will totally jeopardize my plan to have a robot butler if it's going to be eating the TV every time Bart mentions his shorts or Bender mentions his shiny ass. Both those things obviously preferable to it killing all humans obviously.

    Coat.. I'll be getting my own, the one with no robots in the pockets.

  15. This post has been deleted by its author

  16. Anonymous Coward
    Anonymous Coward

    Now if you could install an app via siri

    That could be fun.

    A Techno ring tone, that installs itself on other phones that hear it.

  17. Anonymous Coward
    Anonymous Coward

    That doesn't sound very obstructed to me, i could understand every example, notice how the test speakers they use are 2.1. As far as i can tell all they did is use a frequency shelf to squash/reduce the upper frequencies. From what i can work out they needed a reasonable low frequency speaker to make it work effectively, hence the 2.1. Finally most people i know dont set their device for always listening due to the battery sucking effects of having it always listening so its a bit pointless. Now if they had used some form of phasing effect passing different parts/components of the audio to left and right channels and use some stereo widening effect to deceive the human ear, even better doing this with a 7.1 system, but the sound would recombining in the mono microphone, i would have been more impressed, but instead they just fiddled with EQ and declared it a success.

  18. GrumpyOldMan

    I think youre missing the point

    The majority of users - your mum, kids for example, non-techies or those for whom security online is something nerds and the tinfoil hat brigade get upset about and they need to get a life (until someone hacks their phone and gets theirs) - they leave everything bog standard, unchanged and unprotected. How many people still have laptop mic and cameras or phone cameras uncovered despite well-published RAT attacks? This is purely a proof of concept system. The fact a distorted voice can be made to activate a phone even with background noise means that it could be refined so that the commands are HIDDEN in the background noise. So all kinds of havoc could be created. Or surveillance...

    How many times have you stood on a railway platform or in a large atrium and not understood a word of the announcements? But suppose your phone can? Would you think it was a phone attack or 'just the usual c**p announcement system"?

    Remember the TV advert for X-Box or Kinnect - can't remember which one it was - a year or 2 ago that activated peoples consoles of they were switched on and near the TV? Suppose they put something in the ad to activate your phone and pull up the website for the product? Or worse... order one for you? And here's a free virus while we're at it...

    And who was it a few months ago on this hallowed site that said his phone was pulling up websites for sanitary pads after a conversation in the car with his wife?

    Or maybe I'm just paranoid. Prepare to be Boarded lcon - cos you might be!

    I'll get me tin hat.....

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like