Whenever the trigger phrase is spoken (which is trained to the device owner’s voice), a prompt tone is played back, which will be heard through the headphones.
So… you’ve got to get in fairly close proximity to the victim, hope they have headphone’s plugged in, then send a signal that you hope sounds enough like the device owner’s voice that it triggers the voice command function, without the device owner noticing that the audio they had been listening to was halted, and the voice prompt tone was played though the headphones.
I’m not too worried about this one.
BTW, the shielding scheme is stupid, as the phones with FM radios are designed to use headphone wires as an antenna. My GS6 has a built-in FM radio, but you can’t even activate it unless there are headphones plugged in.
Use optical headphone cables with a DAC built in to the earpieces. What could be easier?
Alternatively, the queen of diamonds can be displayed to the phone’s camera.
A safe environment for security researchers to conduct themselves in?
Giving a Like, just for the semi-obscure reference.
Yeah, because people have been clamoring for stiffer, harder to store earphone wires.
Google Now voice commands are turned off by default when you plug in headphones for exactly this reason. Even once turned on they aren’t hot mic, you have to push the button on your headphones first.
From what I understand, the hack can simulate pushing the button.
Having to charge your headphones’ batteries, rather than the simple passive arrangement, would be a pain in the ass; but for the distances and data rates we are talking here, I would not be at all surprised if optical cabling at least as flexible and durable as the copper stuff could be used.
Plastic optical fiber has lousy attenuation, and some of the really cool tricks used to squeeze bandwidth out of glass runs don’t work; but if you are dealing with a maybe 2-meter run, at low speed, you can get away with any number of optically unimpressive options.
Well, how would you expect the average device owner to react when the audio playback suddenly goes silent and a prompt tone is played back? I guess most people would apply Hanlon’s razor and assume a bug rather than an attack.
And they’d be right 90% of the time. I’d consider it entirely possible for a device to mistake random background noise for the trigger phrase. I assume the situation has much improved, but many uses will still remember earlier speech recognition systems, some of which would randomly hallucinate trigger phrases in a crowded room.
So my guess is that most people would suspect nothing and turn off speech recognition only when their favorite song, audiobook or podcast is repeatedly interrupted.
I’d be very surprised if optical could match conductive wires for flexibility, especially when compared to the flat cables used, for example, by Klipsch on some of their in-ear headphones. They’re incredibly limp and flexible, and don’t get tangled.
Besides, this “hack” only works on 4-conductor earphones with a mic. Unless you can figure out how to include a mic with an optical system, it’s a moot question, as you can just use non-mic 3-conductor earphones, and the “hack” will fail.
If you’re adding batteries to the equation, why not just use Bluetooth? With AptX the quality is pretty good now, and since you’re already paying the penalty of charging them you might as well get the convenience of wireless (which, if appropriately configured, should be nearly as safe as optical, and much safer than analog copper). Or alternatively just run digital signals over copper to the DACs - then you can make the protocol arbitrarily difficult to mimic through radio interference (all the way up to encryption if you really need to) while still maintaining the benefit of power carrying copper.
Then you just market them as tangle-resistant headphones 
This topic was automatically closed after 5 days. New replies are no longer allowed.
