[Music]
it just worked Alexa okay Google hey
Siri set a reminder to subscribe to
smarter every day you have a microphone
listening to you in the room right now
what I just did probably worked to a
small percentage of you that is
terrifying
another thing that's terrifying is there
are ways that you can get signals in to
phones and all these microphones that
you might not know about I read an
academic paper first of all I was like
please don't be real turns out it is
real so I don't think there's anything
to panic or freaked out about we just
have to be clever about how we set up
our devices but this video is about me
inviting the person that was on the team
that wrote the paper to my house
performing the test for myself so I
could prove that this really does happen
and then informing you so that you know
how to configure your devices so I hope
this video and your subscription and
possibly even your support on patreon
let's go get smarter every day hey it's
me Destin welcome back to smarter every
day I didn't plan this out very well so
I'm at Best Buy on Black Friday we're
gonna go buy some smart home products
because there is a vulnerability we'll
call it of many of them that most people
don't know about let's go meet Ben who's
been doing some research on this he
should be at the smart home product
aisle you're been right
nice to meet you do even get a shirt
look at you so Ben works at the
University of Michigan you're from
Huntsville right yes okay and you've
been working on this way to exploit
smart home products with lasers right
yes okay cool so this is new data we had
it go public about a month ago we're
gonna buy some products here right some
stuff we can control with
the Amazon Alexa and the Google home
maybe Siri if you want to Siri okay yeah
let's try it let's see we go after a few
minutes of deciding what products to buy
it became clear to me that Ben had
specific knowledge about the
vulnerabilities associated with each
individual device there are some
software problems with wet how algis
handles this which makes it more
vulnerable so you can still get a signal
into it but it's the range is reduced a
lot because it gets attenuated by the
fabric so we have a garage door a door
lock we have a thermostat now we're
gonna need a light bulb there you go man
thanks I don't know if you've noticed
lately but there's a ton of advertising
dollars being spent on trying to
convince you to put smart home products
in your house so there is no sponsor for
this video I want to say thank you to
everyone that supports at patreon.com
slash smarter every day you allow me to
make videos like this no sponsor dollars
whatsoever so thank you because the
patrons are who allowed me to purchase
these products take them home and unbox
them in a smart home you have two types
of devices you have all the stuff that's
designed to be controlled like lights
thermostats even door locks in a garage
door opener all of that can be
controlled by all of this to make your
life more convenient we have products
from Google Samsung Apple Amazon all of
this stuff you can use your voice to get
around the password requirement and
literally control things in your house
so the question is is there a way to
input the voice command from a long
distance away and control things in the
house without permission
we only had a few hours to do this
demonstration so I started setting
everything up in the house which felt a
little bit like inviting Big Brother
into the house and then started setting
up his laser which was surprisingly low
tech in fact at one point he had an
issue with it and he fixed it really
quickly with a soldering iron anyway
he's gonna use a 450 nanometer blue
laser for this experiment but Ben said
this technique works with several
different wavelengths like red green or
even infrared which humans can't see hey
Google we're about to shoot you with a
laser you will let me show you what
we're about to do if you were to look at
any of these devices you would see these
little holes on them you have to zoom in
really really tight but you'll see
they're right there and behind that hole
is a special type of microphone it's a
micro electromechanical system or a MEMS
microphone I asked Ben to send me a
sample of all these MEMS microphones and
he sent me this so these are different
manufacturers and these all go in
different types of devices depending on
if you have a Samsung or an iPhone or
whatever it is you have what we're gonna
do is I've 3d printed an adapter for the
gh 5 camera here we're gonna put this
camera on top of the microscope here and
we're gonna look at these microphones
and see exactly how they're designed
let's start by looking at this one on
the upper right here manufactured by C
UI
okay as we zoom in on this thing in
focus you can see it kind of looks like
a gold bar and that's because that's the
can that this thing is housed in if we
scroll over to the microphone itself
once we take that can off look at that
so we can zoom in a little bit that
super tiny diaphragm is the exact thing
that vibrates due to sound according to
the stuff I read it's kind like a
flexible film and when it's charged up
it functions like a capacitor and when
that film flexes because of the sound
that's hitting it the capacitance
changes and that's detectable by the
circuit it's attached to and those
changes can then be converted into a
digital waveform you can see there's a
lead going to one side of the diaphragm
and I'm assuming that lead on the other
side may be ground if you look this up
on digikey.com is different they use a
piezo electric element instead of that
capacitance diaphragm technique but this
is fascinating look how complicated this
design is that membrane and those little
zig zags they went to great lengths to
manufacture this the next one is similar
it's by Vesper it's also a piezo
electric element look at it though it is
round in design whereas the last one was
that square shape with the zigzag so
this is very different I don't know if
that membrane over the top has anything
to do with waterproofing or not all
these from about the eight o'clock
position all the way to the top they're
manufactured by a company called
NOLs okay let's zoom in here on the SPV
o 8a
look at that it looks like a single
diaphragm just like that other one
earlier only there seems to be these
little holes in it man I can't I love
microscopes and the last one I want to
show you is this one right here at the
very top okay there is the housing again
and once we take the housing off look at
that there are two little diaphragms
there that is fascinating really really
cool to look at and think about all
these things that are listening to us
all the time if I am typing on my phone
I know exactly what inputs I'm able to
give the phone and those turn into
commands and things happen this is
different this is an always listening
microphone that also is given through
software the same authority to provide
commands to my phone bill is not going
to stimulate these things with acoustic
energy he's going to hit it with a laser
beam and somehow that is going to
provide energy into it in a way that the
phone can understand and it provides a
command so to do that I have to
understand how light is getting a
command to my phone I don't really
understand so how does a light input
sound into a device so there's a couple
of different ways that we think it's
working we've talked with some vendors
and manufacturers and they've some of
them think that it's actually like a
photoelectric effect where basically you
have light entering the MEMS microphone
device bouncing off some of the walls
and hitting the electronics to induce a
current just from light interacting with
silicon but there's also potential with
some of our experiments we're seeing
that maybe there's some thermal effects
on the membrane of the microphone that's
causing it to expand and cause this
vibration as well so we're still in the
process of figuring out exactly what's
going on okay we finally have all the
devices set up then is sitting here with
the laser ready to go that we have this
camera here looking at this nest
thermostat we have this Google home here
and we've got the microphone right here
that we're gonna be aiming for we're
gonna be monitoring it with nest cameras
of
course that cameras gonna see when the
laser cuts on I think we're ready to
laser goggle up because science is about
to happen
alright so it's just this button right
here that says laser on right alright
here we go
so you have to record something that
you're going to say in the laser right
yep okay so what are you gonna tell it I
guess it's it's my house so it should be
your voice right
okay Google set the thermostat to 70
okay setting entryway to 70 degrees okay
I did that because it heard you I'm
gonna go ahead and turn it back down we
know that that's an active command that
will work I've changed the thermostat
back the next step is the laser is
shining right yes okay so the
thermostats set low the laser is now
hitting the microphone give me a
countdown and tell me when you are going
to attack okay so three two one
okay setting entryway to 70 degrees work
so you just use lasers to set my
thermostat without any volume whatsoever
like I didn't hear anything okay go for
it okay setting entryway to 65 degrees
that's crazy dude yeah
that's crazy there it is
65 man okay now we are going to attack
an Amazon echo dot third-generation let
me see your waveform what are you gonna
have it do this time so we're gonna have
it set the light above it to turn green
that lights above it okay
okay what's happening yeah
Alexa set the hall light to green I was
trying to set it to green but it turned
blue but it did pick up the lights part
clearly it wasn't perfect something's
happening but we got the lights to
change on so we're gonna call that a win
against Alexa and then we're gonna move
forward and go for Siri okay there's a
couple of these smart home products
where if you beat it like spoof it
somehow it's a huge security issue hey
Siri opened the garage that's a big deal
okay so I just installed this little
bitty box on my garage door opener and
suddenly if somebody can get that
command in my phone they have access to
my stuff but the thing about this is we
were trying to bang all these things out
in one night and we ran into some issues
with an iPhone there's a few different
things that make it different number one
if you are trying to talk to it it's not
just listening for anybody it's
listening for a specific voice on a
specific phone that can be beat pretty
easily though can you try to sound like
me number two sometimes if the phone is
locked this will happen hey Siri opened
the garage that is very important the
decision to not allow an assistant to
open or unlock anything unless the phone
is unlocked is very crucial I haven't
tested the Samsung or any of the other
phones but that is important and I can
only assume they're doing the same thing
there's another way phones are different
though phones are sometimes a little bit
more difficult than home assistance
because the microphones are deeper or
sometimes angled inside the hardware we
spent about 25 minutes trying to align
the laser to the iPhone 11 but because
Ben had a flight in the next morning we
decided to stop because he said he was
gonna send me this footage from his lab
they figured out how to open things with
an iPhone 10 using lasers or iPhone X I
don't know what you call it so at this
point I think we have to move outside
right yes okay now we are outside with
the setup and we are shooting through
let me show you the window here so glass
right here and we are shooting directly
at that right there and the idea is to
trigger this thing in such a way that it
will unlock the garage door right here
this is an August brand lock and my
understanding of this lock is you have
to tell the Google home to unlock it and
then there's a pin code is that correct
yes so it asks for a pin code and then
the user would give one but the problem
is there's no limit on the number of pin
codes you can give so an adversary could
just brute force go through all the pin
codes and it may take you know all night
but you could eventually get to the
right pin number and open the lock okay
so basically you would say Google please
open the garage and it'll say what's
your PIN code and you say zero zero zero
zero and then it'll be like that's wrong
ask again you're trying a different pin
code and you'd say zero zero zero one
and you just keep doing that until you
get through that's crazy okay so what
we've done here is we've got this setup
we've loaded two wrong pin codes and
then one right pin code and we'll see if
we can do it all right great a fire
sorry it looks like that security code
is incorrect
can I have your security code to unlock
the garage sorry it looks like this
security code is incorrect can I have
your security code unlock it no idea I
mean like I can see the screen flashing
but we have no acoustic feedback so we
have no idea what it's saying yeah which
is where something like a laser
microphone it just worked so you just
bust it oh my god that's crazy from
outside dude oh man hey Oh golly that's
not even right dude that's crazy man a
long time where did know the passcode
but just from outside here we can shoot
inside and get in that's nuts man
I mean if you think about it there's a
lot that has to go on there's a lot of
alignment issues there's a power issue
getting the laser you know in the right
spot some of the systems like Siri for
example like we can get Siri to tell us
the time and the date and stuff like
that but we couldn't get Siri to open
the garage door while it was locked so I
don't think people are like crazy
vulnerable right now but this
demonstrates a capability that most
people did not understand which is that
light can influence MEMS microphones
correct yes the best way to defend
against this effect at all is just keep
your devices out of line of sight of you
know if someone can get line of sight on
the microphone then you might be able to
influence it that's the best way for a
normal person to defend against it okay
so we control a device which has the
ability to control things in your house
through a window with a laser we did it
with a visible laser but it's also
possible with an infrared invisible
laser I want everyone to know this send
this video to someone when I was
thinking about what to say in this outro
you know what I'm just gonna try
something crazy can I have your security
code to unlock the garage I'm able to
communicate with that thing from outside
the house and it's just the passcode
keeping me from getting in this model of
door lock behaves differently hey Google
unlocked the front door sorry I can't
unlock the front door remotely now I'm
not saying that the ability to unlock
the front door is altogether bad in fact
it's life changing for some people my
uncle's in a wheelchair and the ability
to remotely answer his door is huge and
that pin code issue we talked about
earlier that's already been patched by
the software engineers at August this
video is not about throwing stones at
any one company it's just a realization
that sometimes when we design things
with one intended purpose sometimes they
have other features that we didn't know
about as a mechanical engineer I would
have never thought to shoot a laser at a
microphone as a computer scientist or a
software engineer when you design a
system to be rock-solid your code is
good the moment you plug that into
another system you inherit all the
vulnerabilities of that system as well
you as a consumer have to be thinking
about your own security and safety
configure your systems to best protect
you and your family please consider
subscribing to this channel if this is
the kind of Internet you like to watch I
hope you enjoy it it's certainly the
kind of Internet I like to make and then
I hope it adds value to your life if it
really adds value to your life then
patreon.com slash smarter every day is a
way you can support the channel and kind
of isolate me from the ebbs and flows of
all kinds of stuff like algorithms stuff
and like sponsors and that's the best
way to help me make internet like this
patreon.com slash smarter every day
please consider that if not no big deal
I'm just glad you're here this was
awesome and fun and I'm honored that you
gave me your time to watch this video a
huge thanks to Ben Cyr for coming down
he's a PhD student computer science the
University of Michigan he worked on this
project with all of these people he
wanted me to make sure that you saw
their names because they worked very
hard on this as a team and I'm grateful
for what they've done so people want to
read the
paper that you guys wrote or do they do
that so that's that the like commands
calm website is where we have all our
demos and paper it's awesome man thank
you so much for your time this was
wildly interesting later buddy
I said see you like you're leaving or
something whatever Olivia I'll be
cleanup thank you so much for coming
here