A Laser Beam Can Entice Alexa to Spill Your Secrets

It sounds far-fetched – the stuff of sci-fi – but high-tech crooks who see a voice-activated device through a window can tell it to unlock doors via a laser beam.

NEW YORK – A red laser slices through the air, landing on the top of an Amazon Echo sitting inside a house. Suddenly, the garage door opens, a burglar slides in, uses another laser to have the Echo start the car and drives off.

SOME BROKERS USE ALEXA AS A HOME TOUR VIRTUAL ASSISTANT

A series of Echo or Echo Dot devices located around a house can supply answers when a potential buyer say something like, “Alexa, tell me about the kitchen” – and it also subtly markets the smart-house benefits of a smart-home listing.

 

Sound far-fetched? It’s not anymore.

Researchers from the University of Michigan have used lasers to exploit a variety of voice-activated devices, giving them access to everything from thermostats to garage door openers to door locks. The researchers have communicated their findings to Amazon, Google and Apple.

The researchers discovered the microphones in the smart devices would respond to light as if it were sound. The attack can be mounted using a simple laser pointer, a laser driver and a sound amplifier, researchers said on the website.

So how does it work?

“Microphones convert sound into electrical signals,” the research says. “The main discovery behind light commands is that in addition to sound, microphones also react to light aimed directly at them. Thus, by modulating an electrical signal in the intensity of a light beam, attackers can trick microphones into producing electrical signals as if they are receiving genuine audio.”

In other words, the microphone reacts to the intensity of the laser light the same way it reacts to changes in pressure from sound waves.

So, a hacker can record their voice issuing a command, use a laser modulator to transform it into laser pulses and send it into a device, which then operates as if someone were talking.

So how do you stop it?

The most obvious way is to make sure your voice-activated devices are not in sight of a window. The devices also can be placed behind something, such as a bookcase, TV or picture. That’s because while light waves don’t, sound waves easily go around objects – meaning the device would still respond to a voice, said Benjamin Cyr, one of the researchers at U-M.

What won’t work is simply placing tape over the microphone. The researchers tested several devices with dirt shields over the microphone spot and the laser still worked.

There’s a bigger lesson here as well, according to Daniel Genkin, another of the researchers, who said hackers are looking to exploit any vulnerability they can find.

“We need to do security by design,” he said.

Copyright 2019, USATODAY.com, USA TODAY