2

I recently came upon a program called Sonar power saving that uses speakers and microphone to put the computer in power saving mode as long as you move away from the screen. http://stevetarzia.com/sonar/ This provides some sort of security level for the casual colleague who wants to get a look in your computer when you go away and you forget to lock out etc. But from another point of view , it is mind blowing the number of attacks you can issue using similar techniques. As far as i know there are no security measures to employ easily.(except remove your build in mic and speakers and use external ones :D). While using 'Sonar power saving' even 'simple' Dos attack from someone around transmitting same high frequency sounds to freak me out seems possible:)

Also

I read an article about transmitting malware using speakers and microphone and i am looking for some technical background how is that possible . If anybody has some more resources on this issue . Transmitting malicious code over audio speakers

How to protect against this kind of attacks.

1 Answer 1

4

First, understand that the microphone can't be used as a malware vector without a program actively interpreting the data being received by it. You can bleep all you want, but unless some kind of program is listening, reading, and processing the digitized input from the mic, there's nothing entering your computer to perform an exploit.

If you have malware audio somehow floating around in the air near your microphone, you've got an attacker that's very nearby. The wolf has already entered the barn, and is eyeing the sheep. But let's move on to the next part and assume that you have untrustworthy people near your microphone, perhaps sitting next to you in a coffee shop. Now what?

Low level OS or Analog Audio App

If you have some low level hardware or OS program reading the information from the audio digitizer, you have the potential for malware as you would from any unchecked input source. For example, perhaps you have a microphone level utility. It's possible that certain kinds of input could cause a buffer overflow. The problem with using this directly as a vector is that an audio signal is highly variable. Malware needs to send machine instructions, not words and phrases or tones. If you want the victim to receive exactly the bytes of 58 35 4f 21 50 25 40 41 50 (an example from the EICAR pattern) then you have to make a very precise sequence of sounds to make the microphone vibrate in that pattern. But such a sound would be affected by the distance from the speaker to the mic, dampened by a piece of paper, echoed from a tabletop, masked by a vent, or echoes suppressed by a nearby person's body. Plus, there's no feedback to the malware to tell it if it's close or far. The normal background sounds of a coffee shop would suppress any such attack.

This also requires a very badly coded app, one that doesn't actually work. All such simple programs of the type that paint a continuous line level on the screen would fail quickly if they actually had a buffer overflow problem.

So for a low level attack, you're still very safe. It is highly unlikely that malware could successfully be injected under ideal conditions, let alone the real world.

Interpreting audio app

Let's say you have an analog listening program that is actively parsing data and attempting to use it. The sonar program you mentioned would be an example, but perhaps you have a touch-tone listening app - (something like Skype, perhaps?) Certainly, DTMF tones could be interpreted by the victim's computer. They'd also be audible to the user. I suppose it's conceivable that an attacker could get your Skype to call a +1-900-SPEND-MONEY number after you dial a credit card service. But could he realistically touch-tone in a full buffer overflow attack?

A related attack might come from exploiting Shazam. An evildoer could register a malware link with Shazam for a certain piece of audio, and when the interested Shazam user taps the button to "learn more", his browser travels to the infected site.

Another possibility could come from Siri. Perhaps your attacker can convince Siri to open some kind of malware link to infect your phone. Again, not particularly realistic, but it's a potential vector.

Digital audio app

So let's move to the case where you have software that is actually listening for digital audio communications. Shopkick comes to mind, as many people have it installed on their iPhones. Yes, it's technically possible that such an application is badly coded and could permit an attack through the mic. But it's somewhat more likely that a digital attacker would be more successful at masking or confusing the audio than actually finding a bug to exploit.

Digital audio malware app

If the story was true, the BadBIOS attack is malware that is actively using ultrasonic sounds to communicate between machines. Of course, if you already have malware on your system, you already have malware on your system! The wolf not only entered your barn, but he ate your sheep. There's little point in worrying about the communication vector of the malware, because your system is already owned by someone else.

Ultimately, I don't think there are a lot of risks you're taking by using audio applications. The highest risk of any of these activities is likely downloading sonar from a random source on the web.

Bottom line - what is the highest risk?

The highest risk of all is that you could live in irrational fear of random ultrasonic beeps, and so miss out on the advantages you might gain from using digital audio applications.

3
  • Great answer. The main reasons you gave for not worrying against these attacks is interference and not practical implementation among others. Obviously i am not a telecommunication expert so a sub question: the program 'sonar' i attached uses high frequency that cannot be heared by humans. Is this kind of frequency or other frequencies less susceptible to interference and can be used to lunch these attacks through walls or at even 'WIFI distances' ?
    – blended
    Nov 22, 2013 at 21:03
  • 1
    Ultrasonic interference would depend on the power of the interfering transducer and the distance from the mic. Assuming your adversary knows your using sonar, yes, it's possible. Sonar could use countermeasures, tho, by randomizing the frequencies and/or gaps between pings, and listening for false images. It might not be able to function, but it could at least warn you. Nov 23, 2013 at 5:47
  • I disagree that interference would be an intractable problem. You could easily use a proper encoding and error correction codes to avoid any finite percentage of bit errors.
    – forest
    Oct 30, 2018 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.