Security News > 2023 > March > Inaudible ultrasound attack can stealthily control your phone, smart speaker
American university researchers have developed a novel attack called "Near-Ultrasound Inaudible Trojan" that can launch silent attacks against devices powered by voice assistants, like smartphones, smart speakers, and other IoTs.
The main principle that makes NUIT effective and dangerous is that microphones in smart devices can respond to near-ultrasound waves that the human ear cannot, thus performing the attack with minimal risk of exposure while still using conventional speaker technology.
The other method, NUIT-2, is when the attack is launched by a device with a speaker to another device with a microphone, such as a website to a smart speaker.
"If you play YouTube on your smart TV, that smart TV has a speaker, right? The sound of NUIT malicious commands will become inaudible, and it can attack your cell phone too and communicate with your Google Assistant or Alexa devices," explained G. Chen.
"It can even happen in Zooms during meetings. If someone unmutes themselves, they can embed the attack signal to hack your phone that's placed next to your computer during the meeting."
Since smart assistants can also perform actions like opening websites, the attackers could lead smartphones to "Watering hole" websites that can be used to drop malware on the device by exploiting a vulnerability in their browser without interaction by the victim.