Your voice assistant is mine: How to abuse speakers to steal information and control your phone

Proceedings of the ACM Conference on Computer and Communications Security

Volumn 2014-November, Issue November, 2014, Pages 63-74

  Diao, Wenrui ^a   Liu, Xiangyu ^a   Zhou, Zhe ^a   Zhang, Kehuan ^a  

^a CHINESE UNIVERSITY OF HONG KONG   (Hong Kong)

Author keywords

Android security; Permission bypassing; Speaker; Voice assistant; Zero permission attack

Indexed keywords

ANDROID (OPERATING SYSTEM); COMPUTER PRIVACY; REMOTE CONTROL; SMARTPHONES;

ANDROID APPLICATIONS; ANDROID SECURITIES; APPLICATION DEVELOPERS; PERMISSION BYPASSING; PRIVACY INFORMATION; SENSITIVE COMPONENTS; SPEAKER; ZERO PERMISSION ATTACK;

MOBILE SECURITY;

EID: 84937566397     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2666620.2666623     Document Type: Conference Paper

References (57)

1. Android Developers. Common Intents. http://developer:android:com/guide/components/intents-common:html.
2. Android Developers. Intent. http://developer:android:com/reference/android/content/Intent:html.
3. Android Developers. Platform versions. https://developer:android:com/about/dashboards/index:html#Platform.
4. Android Developers. RecognizerIntent. http://developer:android:com/reference/android/speech/RecognizerIntent:html.
5. Android Developers. Text To Speech. http://developer:android:com/reference/android/speech/tts/TextToSpeech:html.
6. AOSP. Headset State Machine. https://android:googlesource:com/platform/packages/apps/Bluetooth/.
7. AOSP. Telephony. https://android:googlesource:com/platform/packages/services/Telephony/.
8. Apple. Siri. http://www:apple:com/ios/siri/.
9. K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. Pscout: Analyzing the android permission specification. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 217-228. ACM, 2012.
10. A. J. Aviv, B. Sapp, M. Blaze, and J. M. Smith. Practicality of accelerometer side channels on smartphones. In Proceedings of the 28th Annual Computer Security Applications Conference, pages 41-50. ACM, 2012.
11. H. Beigi. Fundamentals of speaker recognition. Springer, 2011.
12. S. Bugiel, L. Davi, A. Dmitrienko, T. Fischer, A.-R. Sadeghi, and B. Shastry. Towards taming privilege-escalation attacks on android. In 19th Annual Network & Distributed System Security Symposium (NDSS), volume 17, pages 18-25, 2012.
13. L. Cai and H. Chen. Touchlogger: inferring keystrokes on touch screen from smartphone motion. In Proceedings of the 6th USENIX conference on Hot topics in security, pages 9-9. USENIX Association, 2011.
14. P. P. Chan, L. C. Hui, and S.-M. Yiu. Droidchecker: Analyzing android applications for capability leak. In Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks, pages 125-136. ACM, 2012.
15. E. Chin, A. P. Felt, K. Greenwood, and D. Wagner. Analyzing inter-application communication in android. In Proceedings of the 9th international conference on Mobile systems, applications, and services, pages 239-252. ACM, 2011.
16. A. Clark, C. Fox, and S. Lappin. The handbook of computational linguistics and natural language processing, volume 57. John Wiley & Sons, 2010.
17. CyanogenMod. Google Apps. http://wiki:cyanogenmod:org/w/Google-Apps.
18. A. Das, N. Borisov, and M. Caesar. Do you hear what I hear? fingerprinting smart devices through embedded acoustic components. In (To appear) Proceedings of the 2014 ACM conference on Computer and communications security. ACM, 2014.
19. L. Davi, A. Dmitrienko, A.-R. Sadeghi, and M. Winandy. Privilege escalation attacks on android. In Information Security, pages 346-360. Springer, 2011.
20. S. Dey, N. Roy, W. Xu, R. R. Choudhury, and S. Nelakuditi. Accelprint: Imperfections of accelerometers make smartphones trackable. In Proceedings of the 21st Annual Network and Distributed System Security Symposium, NDSS, 2014.
21. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. Sheth. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In OSDI, volume 10, pages 1-6, 2010.
22. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In Proceedings of the 18th ACM conference on Computer and communications security, pages 627-638. ACM, 2011.
23. A. P. Felt, E. Ha, S. Egelman, A. Haney, E. Chin, and D. Wagner. Android permissions: User attention, comprehension, and behavior. In Proceedings of the Eighth Symposium on Usable Privacy and Security, page 3. ACM, 2012.
24. A. P. Felt, H. J. Wang, A. Moshchuk, S. Hanna, and E. Chin. Permission re-delegation: Attacks and defenses. In USENIX Security Symposium, 2011.
25. H. W. Gellersen, A. Schmidt, and M. Beigl. Multi-sensor context-awareness in mobile devices and smart artifacts. Mobile Networks and Applications, 7(5):341-351, 2002.
26. Google. Google Apps for Android. https://www:google:com/mobile/android/.
27. Google. Use your voice on Android. https://support:google:com/websearch/answer/2940021?hl=en&ref-topic=4409793.
28. M. Grace, Y. Zhou, Z. Wang, and X. Jiang. Systematic detection of capability leaks in stock android smartphones. In Proceedings of the 19th Annual Symposium on Network and Distributed System Security, 2012.
29. C. Hadnagy. Social engineering: The art of human hacking. John Wiley & Sons, 2010.
30. R. Hasan, N. Saxena, T. Haleviz, S. Zawoad, and D. Rinehart. Sensing-enabled channels for hard-to-detect command and control of mobile devices. In Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security, pages 469-480. ACM, 2013.
31. C. Hurtley. Night noise guidelines for Europe. WHO Regional Office Europe, 2009.
32. IDC. Worldwide smartphone shipments edge past 300 million units in the second quarter; android and ios devices account for 96% of the global market, according to IDC. http://www:idc:com/getdoc:jsp?containerId=prUS25037214, August, 2014.
33. D. Kantola, E. Chin, W. He, and D. Wagner. Reducing attack surfaces for intra-application communication in android. In Proceedings of the second ACM workshop on Security and privacy in smartphones and mobile devices, pages 69-80. ACM, 2012.
34. Kaspersky Lab. Kaspersky security bulletin 2013. http://media:kaspersky:com/pdf/KSB-2013-EN:pdf December 2013.
35. Y.-S. Lee and S.-B. Cho. Activity recognition using hierarchical hidden markov models on a smartphone with 3d accelerometer. In Hybrid Artificial Intelligent Systems, pages 460-467. Springer, 2011.
36. Microsoft. Cortana. http://www:windowsphone:com/en-us/features#Cortana.
37. Motorola. How do I setup and use touchless control? https://motorola-global-portal:custhelp:com/app/answers/prod-answer-detail/a-id/94881/p/30;6720;8696/action/auth.
38. Motorola. Touchless Control. http://www:motorola:com/us/Moto-XFeatures-Touchless-Control/motoxfeatures-2-touchless:html.
39. A. Muzet. Environmental noise, sleep and health. Sleep medicine reviews, 11(2):135-142, 2007.
40. E. Owusu, J. Han, S. Das, A. Perrig, and J. Zhang. Accessory: password inference using accelerometers on smartphones. In Proceedings of the Twelfth Workshop on Mobile Computing Systems & Applications, page 9. ACM, 2012.
41. Ponemon Institute. Smartphone security survey of U.S. consumers. http://aa-download:avg:com/filedir/other/Smartphone:pdf March, 2011.
42. S. Rosen and P. Howell. Signals and systems for speech and hearing, volume 29. BRILL, 2011.
43. B. P. Rubin. Google previews "Android L" at I/O. http://www:besttechie:com/2014/06/25/google-previews-android-l-at-io/.
44. Samsung. S Voice. http://www:samsung:com/global/galaxys3/svoice:html.
45. J. Schalkwyk, D. Beeferman, F. Beaufays, B. Byrne, C. Chelba, M. Cohen, M. Kamvar, and B. Strope. "Your word is my command": Google search by voice: A case study. In Advances in Speech Recognition, pages 61-90. Springer, 2010.
46. R. Schlegel, K. Zhang, X. Zhou, M. Intwala, A. Kapadia, and X. Wang. Soundcomber: A stealthy and context-aware sound trojan for smartphones. In Proceedings of the 18st Annual Network and Distributed System Security Symposium, NDSS, 2011.
47. L. Simon and R. Anderson. Pin skimmer: inferring pins through the camera and microphone. In Proceedings of the Third ACM workshop on Security and privacy in smartphones & mobile devices, pages 67-78. ACM, 2013.
48. A. Smith. Americans and their cell phones. Pew Internet & American Life Project, 15, 2011.
49. R. Templeman, Z. Rahman, D. Crandall, and A. Kapadia. PlaceRaider: Virtual theft in physical spaces with smartphones. In Proceedings of the 20th Annual Network and Distributed System Security Symposium, NDSS, 2013.
50. VB-Audio Software. VB-Audio Virtual Cable. http://vb-audio:pagesperso-orange:fr/Cable/.
51. Wikipedia. Sound pressure. http://en:wikipedia:org/wiki/Sound-pressure.
52. L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang. The impact of vendor customizations on android security. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 623-634. ACM, 2013.
53. L. K. Yan and H. Yin. Droidscope: seamlessly reconstructing the os and dalvik semantic views for dynamic android malware analysis. In Proceedings of the 21st USENIX Security Symposium, 2012.
54. X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang. The peril of fragmentation: Security hazards in android device driver customizations. In Security and Privacy (SP), 2014 IEEE Symposium on. IEEE, 2014.
55. Y. Zhou and X. Jiang. Dissecting android malware: Characterization and evolution. In Security and Privacy (SP), 2012 IEEE Symposium on, pages 95-109. IEEE, 2012.
56. Y. Zhou, Z. Wang, W. Zhou, and X. Jiang. Hey, you, get off of my market: Detecting malicious apps in official and alternative android markets. In Proceedings of the 19th Annual Network and Distributed System Security Symposium, pages 5-8, 2012.
57. Z. Zhou, W. Diao, X. Liu, and K. Zhang. Acoustic fingerprinting revisited: Generate stable device id stealthily with inaudible sound. In (To appear) Proceedings of the 2014 ACM conference on Computer and communications security. ACM, 2014.