Unheard Threats: Securing the C-Suite in the Age of Ultrasonic Attacks

Unheard Threats: Securing the C-Suite in the Age of Ultrasonic Attacks

The cyber landscape is in a constant state of flux, presenting both opportunities and unforeseen threats. As C-suite leaders, safeguarding sensitive data and maintaining a secure environment is not just a priority. It’s an imperative. While traditional cybersecurity measures remain crucial, a recent development demands our immediate and undivided attention: ultrasonic hacking. This insidious threat has already infiltrated companies across various industries, including [industry examples], underscoring the need for swift and decisive action.

  • Hackers can exploit ‘SurfingAttack’, a form of ultrasonic hacking, to issue silent commands to voice assistants in your devices (like smartphones).
  • This attack uses inaudible sound waves transmitted through solid objects (think tables) to bypass traditional security measures.
  • Hackers can potentially steal sensitive information (like two-factor authentication codes) or even make unauthorised calls without your knowledge.

This emerging attack vector, ultrasonic hacking, leverages inaudible sound waves to bypass conventional security protocols. It transmits malicious commands through seemingly innocuous conversations near voice-activated devices, such as discussing the weather or asking for a recipe, triggering unauthorised actions. These actions could include:

  • Data Exfiltration: Hackers could steal sensitive information like financial records, bank account details or transaction history, or intellectual property, such as trade secrets or proprietary algorithms.
  • Financial Manipulation: Malicious actors could initiate unauthorised transactions or disrupt critical financial processes.
  • Reputational Damage: A compromised voice assistant issuing offensive or misleading commands could have severe reputational consequences.

The potential impact of ultrasonic hacking is not limited to financial loss. Breaches of confidential data could undermine customer trust, while compromised voice assistants could paralyse critical operations. The cost of ignoring this threat is not just high, and it’s simply unacceptable.

Here are some ways to safeguard against ultrasound hacks tailored for a C-Suite audience:

Mitigating the Threat:

  • Software Updates: Prioritise updating software on all devices, especially voice assistants. Patches often address security vulnerabilities that these attacks could exploit.
  • Network Segmentation: Segmenting your network can minimise potential damage. The attacker’s access is restricted by isolating sensitive data and systems, even if a voice assistant is compromised.
  • Employee Awareness: Educate employees about cybersecurity best practices. Encourage caution when using voice assistants in public or unsecured environments. Knowing the signs of a potential attack empowers employees to act accordingly.
  • Secure CEO as a Service: Be sure to subscribe to Secure CEO as a Service for a personalised Information Security strategy.

While the likelihood of an ultrasound hack may seem low, the potential consequences are significant. Implementing these proactive measures can significantly bolster your organisation’s defences against this emerging threat.

Additional Considerations:

  • Voice Assistant Settings: While not a foolproof solution, explore the privacy settings on your voice assistants. Disabling features you don’t use can potentially reduce the attack surface.
  • Shielding Strategies: Emerging research suggests possibilities for physical barriers that might mitigate ultrasonic attacks. However, this is a developing area and may not be a practical solution for all situations.

Remember, cybersecurity is an ongoing process. Staying informed about evolving threats and implementing a layered defence strategy is crucial for protecting your organisation’s sensitive data and maintaining a secure digital environment.

Here are some actionable steps to mitigate the risk of ultrasonic attacks: Heightened Awareness, Security Audits, Multi-Factor Authentication, and Emerging Technology Adoption.

  • Heightened Awareness: Educate executives and staff on the potential of ultrasonic hacks. Encourage vigilance in public settings where voice assistants are used.
  • Security Audits: Conduct comprehensive security audits to identify vulnerabilities in voice-activated systems and implement necessary security patches.
  • Multi-Factor Authentication: Move beyond traditional passwords and implement behavioural multi-factor authentication to add a layer of security in the defence-in-depth strategy.
  • Emerging Technology Adoption: Explore solutions that leverage more robust authentication methods like voice biometrics or ultrasonic jamming devices to deter unauthorised access further.
  • Penetration Testing: Perform thorough penetration testing on all the devices within an organisation.

The ROI of Vigilance

Investing in measures to mitigate ultrasound hacking offers a high return on investment. The cost of a successful attack can far outweigh the expenses of preventative measures. By prioritising cybersecurity, businesses can ensure their critical data’s confidentiality, integrity, and availability.

While ultrasound hacking may seem like something out of a spy movie, it’s a real threat that demands attention. By taking a proactive approach, businesses can shield themselves from this silent storm and ensure a secure digital environment.

Ultrasonic hacking poses a new and significant threat to C-suite security. However, organisations can take control of these risks and ensure a secure digital environment by implementing proactive measures and a layered security strategy. Remember, a proactive approach is not just more practical. It’s also more cost-efficient than reacting to a security breach. Let’s harness innovation and best practices to stay ahead of the curve and protect our digital assets.

Why humans cannot hear Ultrasound?

We can’t hear ultrasound because of the limitations of our ears and how they perceive sound. Here’s a breakdown for a C-Suite audience:

  • Frequency Matters: Sound is essentially a wave, and its frequency determines the pitch we hear. Humans have a limited range of audible frequencies, typically between 20 Hz (hertz) and 20,000 Hz.
  • Ear’s Design as a Filter: Our ears act like filters, with different parts responding to specific frequencies. Ultrasound, with frequencies exceeding 20,000 Hz, falls outside the range our ears can process.

Analogy for Business Leaders:

Imagine a team tasked with processing incoming information. They can only handle data within a specific range. The team wouldn’t recognise or process information outside that range (like an ultrasound wave).

The Science Behind It:

The inner ear, specifically the cochlea, contains hair cells that vibrate to sound waves. These waves are then translated into electrical signals the brain interprets as sound. However, the hair cells have physical limitations. For high-frequency sounds like ultrasound, the vibrations are too rapid for the hair cells to keep up, rendering them inaudible.

Ultrasound has a variety of applications beyond the niche area of hacking. Here are some standard devices that utilise ultrasound:

Medical Field:

  • Diagnostic Ultrasound Machines: These are the most familiar examples of generating images of internal organs, foetuses, and blood flow.
  • Therapeutic Ultrasound Machines: Ultrasound can be used for pain management, physiotherapy, and promoting tissue healing.

Industrial Applications:

  • Non-Destructive Testing (NDT): Ultrasound is used to detect cracks and flaws in materials without damaging them, which is crucial in various industries.
  • Cleaning Systems: High-frequency ultrasound waves can be used for industrial cleaning applications.

Consumer Products:

  • Humidifiers: Some humidifier models use ultrasound to create a fine mist.
  • Ultrasonic Cleaners: These compact devices use ultrasound to clean jewellery, eyeglasses, and other delicate items.

Security Systems:

  • Motion Detectors: Certain motion detectors employ ultrasound to create a field and sense disruptions caused by movement.

How Does the SurfingAttack Work?

MEMS microphones, a standard in most voice assistant-controlled devices, contain a tiny, built-in plate called the diaphragm, which, when hit with sound waves, converts it to an electrical signal that is then decoded to the voice commands.

  • Tiny Microphone, Big Problem: Most voice assistants use miniature microphones (MEMS microphones) to capture voice commands.
  • Ultrasound as a Secret Weapon: SurfingAttack uses inaudible sound waves to trick these microphones into registering them as voice commands.

The novel sound attack exploits the nonlinear nature of MEMS microphone circuits to transmit covert ultrasonic signals.

— high-frequency sound waves not audible to humans — using a $5 piezoelectric transducer attached to a table surface. Moreover, the attacks can be executed from as far as 30 feet.

To covert the attack from the victim, the security researchers then issued a guided ultrasonic sound to adjust the volume low enough to make responses unnoticeable while still being able to record the voice via a hidden tapping device closer to the victim’s device underneath the table.

Once configured, an interloper can not only start taking the voice commands in the voice assistants (e.g., using “Hey Alexa”, “OK Google”, or “Hey Siri” as voice commands) but also generate attack commands (e.g. “read my mail” or “call Ram with speakerphone”) using text-to-speech (TTS) — all of which are sent in the form of ultrasonic guided wave signals that can travell along the table to control the devices.

SurfingAttack was tested with various devices that use voice assistants, such as the Macbook Pro, Google Pixel, Apple iPhone 14, Samsung Galaxy S9, and Xiaomi Mi 8, and each was found to be vulnerable to ultrasonic wave attacks. It also worked despite using different table surfaces (e.g., metal, glass, wood) and device configurations.

The experiments, however, come with two unsuccessful scenarios, examples- Huawei Mate 9 and Samsung Galaxy Note 10+, the previously compromised. Analysing the recorded sounds of the ultrasound commands from Galaxy Note 10+, it was found that the structures and materials of the phone body were fragile.”

In what’s a significant consideration, smart speakers from Google and Amazon — Google Home and Amazon Echo, Apple’s HomePod — were not found to be impacted by this attack.

Voice Attacks on the C-Suite

While there are no indicators of compromise that it has been maliciously exploited, this is not the first time injection attacks have been revealed.

Indeed, the security research builds upon a recent string of studies —

BackDoor, LipRead, and DolphinAttack — that demonstrates it’s possible to exploit the non-linear microphones to deliver inaudible sound to the system via ultrasound signals.

Light Commands

— that utilised lasers to inject inaudible sound into smart speakers and surreptitiously caused them to lock doors, shop online, and even start smart cars.

While this attack required the laser light to be in direct sight of the target, the SurfingAttack’s unique propagation capabilities eliminate this need, allowing a malicious hacker to remotely interact with a voice-activated device and execute unauthorised voice commands.

How can dogs hear ultrasound?

Here’s how dogs can hear ultrasound:

  • Superior Hearing Range: Dogs have a much more comprehensive hearing range than humans. While humans can typically hear between 20 Hz and 20,000 Hz (20 kHz), dogs can detect sounds well above that, reaching frequencies as high as 47,000 Hz or even 65,000 Hz, depending on the breed.
  • Evolutionary Advantage: This enhanced hearing is a legacy from their wild ancestors, wolves. It helped them detect prey sounds like high-pitched rodent squeaks or bat calls beyond human earshot.
  • Ear Design Matters: The shape and mobility of a dog’s ears also contribute to their superior hearing. Their ears can swivel and tilt independently, allowing them to pinpoint the source of sounds more accurately.

So, next time a dog perks up at a seemingly silent noise, it might just be picking up on some ultrasonic activity you can’t hear!

Apple HomePod

The Apple HomePod is a smart speaker with Apple’s Siri virtual assistant built in. It is known for its high-fidelity audio and integration with Apple devices and services. However, the Apple HomePod is not specifically designed to be resistant to ultrasound hacking like SurfingAttack.

Here’s a breakdown for C-Suite executives:

  • Apple HomePod Functionality: The HomePod excels in sound quality and smart home control through Siri. However, its security focus might be on data privacy rather than resilience against novel attacks like SurfingAttack.
  • SurfingAttack and Apple HomePod: While there are no reported successful SurfingAttacks on HomePods specifically, the device’s reliance on microphones makes it theoretically vulnerable.

Safer Practices with Voice Assistants:

  • General Security Measures: The mitigation strategies mentioned earlier (software updates, network segmentation, employee awareness) are still important for overall security, including HomePod use.
  • Limited Public Use: Consider using HomePod primarily in secure environments like conference rooms within your own office.
  • Alternative Control Methods: When possible, use touchscreens or keyboards for sensitive interactions instead of voice assistants.

By following these practices, you can minimise the risk of potential security breaches on Apple HomePods and other voice assistant devices within your organization.

It’s important to note that unlike some competitor smart speakers, Apple prioritizes user privacy on HomePod. This means your data is less susceptible to unauthorized access.

Google Home

Just like Apple HomePod, Google Home speakers with Google Assistant are also susceptible to SurfingAttack in theory. Here’s a breakdown for C-Suite executives:

  • Google Home and Vulnerability: Google Home speakers rely on microphones, making them potential targets for SurfingAttack’s inaudible voice commands.
  • Reported Cases: Similar to Apple HomePod, there haven’t been any widespread reports of successful SurfingAttacks on Google Home devices.

Security Recommendations for Google Home:

  • Patch Management: Ensure all Google Home devices are updated with the latest security patches. These fixes may address vulnerabilities that SurfingAttack could exploit.
  • Network Segmentation: Segment your network to limit potential damage. If a Google Home speaker is compromised, isolate it to prevent attackers from accessing sensitive data on your network.
  • Employee Awareness: Educate employees about cybersecurity best practices, including caution when using Google Home in public or unsecured environments. Train them to identify suspicious activity, like unauthorized actions or changes to settings.

Additional Considerations:

  • Privacy vs Security: While Google prioritises user privacy on Google Home, it might not necessarily translate to enhanced security against novel attacks like SurfingAttack.

Balancing Convenience and Security:

  • Limited Use in Sensitive Areas: While Google Home offers convenience, consider restricting its use in conference rooms or other areas where sensitive information might be discussed.
  • Alternative Control Methods: Whenever possible, prioritize using secure methods like touchscreens or keyboards for sensitive interactions instead of voice assistants.

By implementing these recommendations, you can significantly reduce the risk of potential security breaches on Google Home devices within your organization. Remember, cybersecurity is an ongoing process. Staying informed and implementing a layered security approach is crucial for protecting your organisation’s data.

Amazon Echo

Here’s a breakdown of Amazon Echo and SurfingAttack for C-Suite executives:

  • Amazon Echo and Microphone Vulnerability: Amazon Echo devices, powered by Alexa, are susceptible to SurfingAttack in theory. Their microphones can be tricked by ultrasonic waves to register inaudible commands.
  • Reported Cases: There have been instances of vulnerabilities in Echo devices that could be exploited for voice control using sound manipulation, though not specifically SurfingAttack. In 2020, researchers identified a way to exploit a since-patched flaw to potentially steal voice history or make unapproved purchases.
  • Amazon’s Response: Amazon prioritizes security updates and has addressed vulnerabilities in the past. They likely will continue to do so for future threats.

Security Measures for Amazon Echo:

  • Software Updates: Ensure all Echo devices are updated with the latest security patches. Amazon prioritises updates to address vulnerabilities.
  • Network Segmentation: Segment your network to limit potential damage. If an Echo is compromised, isolate it to prevent attackers from accessing sensitive data on your network.
  • Employee Awareness: Educate employees on cybersecurity best practices, including caution when using Echo in public or unsecured environments. Train them to identify suspicious activity like unauthorized actions or changes to settings.

Additional Considerations:

  • Limited Public Use: Consider using Echo primarily in secure environments like conference rooms within your own office.
  • Alternative Control Methods: When possible, use touchscreens or keyboards for sensitive interactions instead of voice assistants.

Amazon vs. Competitors: While no smart speaker is completely immune, some reports suggest Echo devices might be more susceptible to certain voice control hacks compared to Google Home or Apple HomePod. This could be due to a combination of factors like microphone design or past vulnerabilities.

Overall Security Posture:

By implementing these recommendations and staying updated on security best practices, you can significantly reduce the risk of potential security breaches on Amazon Echo devices within your organization. Remember, a layered security approach is crucial for protecting your organisation’s information.

Apple MacBook Pro

Apple MacBook Pros are not susceptible to SurfingAttack in the same way that smartphones and smart speakers are. This is because SurfingAttack relies on exploiting weaknesses in the microphones of these devices. MacBook Pros have microphones, but they are not the primary way that users interact with the device. As a result, Apple is likely to have prioritized the security of the MacBook Pro’s other input methods, such as the keyboard and trackpad.

Here’s a breakdown for C-Suite executives:

  • SurfingAttack and MacBook Pros: MacBook Pros are not primary targets for SurfingAttack due to their design.
  • Focus on Other Input Methods: Unlike smartphones and smart speakers, users primarily interact with MacBook Pros through the keyboard and trackpad, not microphones.

Security Measures for MacBook Pros:

  • General Cybersecurity Practices: While SurfingAttack is not a major concern for MacBook Pros, standard security practices are still important. These include keeping software updated, using strong passwords, and being cautious about clicking on links or opening attachments from unknown senders.
  • Data Encryption: Consider encrypting sensitive data on your MacBook Pro to add an extra layer of security. This will make it more difficult for attackers to access your data even if they are able to gain access to your device.
  • Physical Security: Don’t leave your MacBook Pro unattended in public places, and be sure to log out or put it to sleep when you’re not using it.

By following these recommendations, you can help to keep your MacBook Pro safe and secure.

Even though SurfingAttack is not a significant concern for MacBook Pros, it is still a good reminder to be vigilant about cybersecurity. By following the tips above, you can help protect your devices and data.

Microsoft Cortana

Microsoft Cortana, the virtual assistant found on Windows devices, is also susceptible to a vulnerability that could be exploited similarly to SurfingAttack, though not the same. Here’s a breakdown for C-Suite executives:

  • Cortana Vulnerability (2018): In 2018, researchers discovered a vulnerability in Cortana that allowed an attacker with physical access to a locked Windows PC to bypass the lock screen and potentially steal information or perform actions using inaudible voice commands delivered through the microphone.
  • Not Identical to SurfingAttack: Unlike SurfingAttack, which transmits commands through solid objects, this Cortana vulnerability relied on gaining physical access to the device.

Security Updates:

  • Patch Available: Microsoft addressed this vulnerability with a security patch in 2018. It’s crucial to ensure all Windows devices are updated with the latest security patches to mitigate such risks.

Security Recommendations for Windows Devices with Cortana:

  • Software Updates: Prioritise keeping Windows software updated on all devices to address vulnerabilities like the one discovered in 2018.
  • Strong Passwords: Enforce the use of strong passwords and multi-factor authentication (MFA) to add an extra layer of security and make unauthorized access more difficult.
  • Physical Security: Physical security is important. Don’t leave Windows devices unattended in public places, and always lock them when not in use.

While Microsoft addressed the 2018 vulnerability, it serves as a reminder for constant vigilance.

Additional Considerations:

  • Limited Voice Assistant Use in Sensitive Areas: Consider restricting the use of Cortana voice commands in sensitive areas or for critical tasks. When possible, prioritise using keyboards or touchscreens for more secure interaction.
  • Alternative Control Methods: Whenever possible, use secure methods like touchscreens or keyboards for sensitive interactions instead of voice assistants.

By implementing these recommendations, you can significantly reduce the risk of potential security breaches on Windows devices with Cortana. Remember, cybersecurity is an ongoing process. Staying informed and implementing a layered security approach is crucial for protecting your organisation’s data.

Leave a comment