Millions of people have one or more smart devices in their homes, including door locks, baby monitors, cameras, audio systems, and appliances. Those gadgets are used to make our daily lives easier, but in some cases, they can make life more difficult as some off those devices are prone to hacking. Case in point: Researchers from the University of Michigan and the University of Electrocommunication (Tokyo) have designed a laser platform that can hack into audio-equipped smart devices via their MEMS-based microphones.
Researcher Takeshi Sugawara stumbled onto this ability by pointing a high-powered laser at the microphone on his iPad, while another researcher wore a pair of headphones to listen for any sounds the mic picked up. They noticed that varying the laser’s intensity over time in the shape of a sine wave (fluctuating at 1000X a second), it creates a high-pitched audible tone. In essence, the iPad microphone converted the laser’s light into an electrical signal.
After a few refinements, the Light Commands platform was born, and the researchers can use it to electronically speak to any device with a MEMS-based microphone and give them commands — be it a smartphone, voice assistants, and video-chat devices (among a host of others). What’s more, they can do so at long distances as long as there is a direct line of sight.
MEMS (microelectromechanical systems) microphones convert voice commands into electrical signals, and while it’s a quick and efficient conversion process, it’s also a newfound design flaw that can be taken advantage of. By pointing the laser at a device and varying the signal, the membrane of the microphone is tricked into thinking it’s an audible signal and converts it to an electrical one.
Amazingly, the researchers discovered that they didn’t have to hit the microphone directly with a laser beam, as in some cases, all they needed to do was flood the device with light to gain access. If the device happens to be a great distance away, they could use a tripod and telephoto lens to hit their mark.
In testing the Laser Commands system, the researchers used a 60-milliwatt laser to ‘speak commands’ to 16 different devices, including smart speakers, smartphones, smart assistants, locks, and more. Most of the smart speakers and assistants registered commands at a distance of 164 feet (the max distance they tested), while iPhones and Android phones were only affected at distances of 33 feet and 16 feet, respectively.
In subsequent experiments, the researchers pushed the limits of their technique using a 5-milliwatt laser to target devices 361 feet in distance utilizing a hallway, and although most testing failed at this distance, they still gained access to Google Home and a first-gen Echo. Another test showed it was possible to send commands to Google Home at 250 feet away through a window at a nearby building.
More information on the Laser Commands platform can be found in the researcher’s recently released paper entitled, “Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems.”