From Apple ’s Siri to Amazon ’s Alexa , smart assistants are now a daily part of many people’s lives.
But if you use a smart speaker to interact with your assistant, you may want to close your curtains when you use it, according to a new study.
Researchers from the University of Michigan have revealed that hackers can now control smart speakers using lasers from as much as 75 metres away.
This vulnerability, which the researchers have called ‘Light Commands’ applies to several popular smart assistants, including Google Assistant, Amazon Alexa, Facebook Portal and Apple’s Siri.
The researchers explained : “In our paper we demonstrate this effect, successfully using light to inject malicious commands into several voice controlled devices such as smart speakers, tablets, and phones across large distances and through glass windows.”
As part of their study, the researchers set up a Google Home speaker in a fourth-floor office, and shone a laser through the window at it, from 75 metres away.
Amazingly, this allowed them to ‘inject’ commands into the speaker.
They wrote: “Despite its low 5 mW power and windy conditions (which caused some beam wobbling due to laser movement), the laser beam successfully injected the voice command while penetrating a closed double-pane glass window.”
Worryingly, this tactic could be used to control not only smart speakers, but also various other smart devices, including garage doors, and even cars.
The researchers explained: “User authentication on these devices is often lacking or non-existent, allowing the attacker to use light-injected voice commands to unlock the target’s smart lock-protected front doors, open garage doors, shop on e-commerce websites at the target’s expense, or even locate, unlock and start various vehicles (e.g., Tesla and Ford) that are connected to the target’s Google account.”
