With so much important stuff on your phone, companies have gone to great lengths to make
them secure.
They’ve taken steps to keep hackers from breaking into your phone, either physically
or digitally, but what about audibly?
Researchers from the University of Michigan and the University of South Carolina have
found it’s possible to hack your phone using sound.
The process works by tricking the phone's accelerometer, the hardware that senses movement
and a word you’re going to hate by the end of this episode.
You know when you flip your phone sideways and it switches to landscape mode?
That’s because of the accelerometer.
That’s twice we said it already.
The researchers tested 20 accelerometer models from 5 different manufacturers by playing
certain sounds over a cheap speaker.
They found 65% of them could be manipulated with a sonic attack.
This isn’t an entirely new concept; previous research has demonstrated that sound waves
could be used to disable accelerometers entirely.
What this research shows is that accelerometers can be finely controlled with sound too, not
just shut down.
The vulnerability comes from a simple oversight: manufacturers didn’t expect anybody to monkey
with the accelerometer, so the software that interprets the input takes it as gospel.
Of course an attack like this can only affect software that relies on the accelerometer,
so it can’t be used to steal your personal info or anything like that.
The scientists demonstrated that sound could be used to drive an radio controlled car that
was controlled by a phone, or hack a fitbit into counting steps while it was sitting still.
Just be lazy but tell yourself you worked.
Awright so that doesn’t sound that alarming, but this could go beyond just phones.
Self driving cars rely on a suite of sensors including accelerometers and so they could
be at risk.
You don’t want somebody meddling with how your car drives in any circumstance, but doubly
so when you’re not steering it.
The researchers imagined other nefarious uses for this exploit.
For example, if an insulin pump relies on an accelerometer to automate dosage, tampering
with it could be fatal.
The good news is most of these attacks can be thwarted with software rather than hardware,
and the researchers contacted the manufacturers of the accelerometers with recommendations
on how to fix the flaws in their designs.
This technique was also only tested on one of the major types of accelerometers, called
a capacitance accelerometer, which works by moving small masses around.
The most common technology relies on piezoelectric accelerometers instead, where microscopic
crystals become stressed by acceleration and create a voltage that is interpreted by a
chip.
The researchers say sound waves could move the small masses inside a capacitance accelerometer,
but it's unclear if the same trick would work on these crystals.
Hacking phones with sound actually has a long and illustrious history.
Starting in the 1950s people who called themselves phreakers with (a “PH”) figured out how
to game the telephone system to make free calls using nothing but sound.
Telephone systems used precise frequencies to route calls, it’s why your phone’s
buttons make specific tones when you press them.
So by playing the right frequencies into the receiver, phreakers could connect to whomever
they liked.
These people were like proto-hackers, with anonymous personas and everything.
Two phreakers who would later become famous were a couple teenagers named Steve Wozniak
and Steve Jobs.
Long before Apple, the two experimented with creating digital circuits that could create
tones to hack phones.
One of their first business ventures was selling homemade phreaking boxes, which actually caught
the attention of the FBI, though they never caught the Steves.
It’s a bit ironic that 40 years after Steve Jobs toyed around with phreaking, people might
be figuring out how to use sound to hack the phones he helped create.
Special thanks to our sponsor, Domain dot com.
When you buy a domain name from Domain Dot Com, you’re taking the first steps in creating
an identity and vision for your brand.
No domain extension will help tell your story like a DOT COM or DOT NET domain name.
Get 15% off Domain Dot Com’s already affordable domain names and web hosting when you use
coupon code SEEKER at checkout.
If you want to learn why it’s hard to hack into a phone with software, check out Julian’s
video on iphone encryption here.
Ok I know I said accelerometer a lot, but I couldn’t help it, there is literally no
synonym for accelerometer.
How many times do you think I said it?
Let us know in the comments and go ahead and subscribe while you’re down there.
Thanks for watching Seeker!
Accelerometer.