Earlier this year, companies like Silverpush were outed for sneaking ultrasonic communications channels into peoples' devices, so that advertisers could covertly link different devices to a single user in order to build deeper, more complete surveillance profiles of them.
In an upcoming Black Hat London presentation, UCL security researcher Vasilios Mavroudis and colleagues will describe how these ultrasonic channels (which are being incorporated as a network channel in an increasing cloud of Internet of Things devices) can be exploited by attackers to spread malicious software throughout homes -- they'll demo an attack where "an attacker equipped with a simple beacon-emitting device (e.g., a smartphone) can walk into a Starbucks at peak hour and launch a profile-corruption attack against all customers currently taking advantage of uXDT-enabled apps."
Before ultrasound goes mainstream, Mavroudis says that it’s time to work out how to regulate it and keep it from being hijacked for malicious purposes. “Ultrasound beacons don’t have specs yet,” he says. “There are no rules about how to build or connect ultrasound beacons. This is kind of a grey area where no one wants to take responsibility.”
He and his co-authors are agitating for standards similar to those that exist for Bluetooth. But that will take a while, so they have also developed countermeasures you can use in the meantime. The first is an ultrasound-filtering browser extension for Google Chrome that blocks any website-embedded beacons from sounding. The second is a patch for Android devices that means users have to opt in to pick up ultrasound beacons and audible sound separately when they give an app permission to use their microphone.
“It’s going to get worse unless we fix it,” says Mavroudis.
Your home’s online gadgets could be hacked by ultrasound
[Sally Adee/New Scientist]
(Image: Ear E-2, Pearson Scott Foresman, PD)
One of UK Prime Minister Theresa May’s government ministers told a reporter from The Sun that the government is planning on invoking the “Technical Capabilities Orders” section of the Snoopers Charter, a 2016 domestic spying bill; the “orders” allow the government to demand that companies cease using working cryptography in their products and services, substituting […]
The TSA will be testing out expanded screening for carry-on electronics larger than a phone and certain food items at selected airports around the country. The new rules come just two days after a major terrorist attack in Manchester, UK, and stepped-up security in response. The TSA says they’re “testing security screening procedures for carry-on […]
1Password has taken Maciej Cegłowski’s demand for a “travel mode” for our technology to heart, introducing a new feature that locks you out of your own accounts when you’re in situations where you might lose control of your devices or be compelled to log into your accounts without your consent.
Boasting an IPX6 waterproof rating, the Trakk Bullet Ultra Compact Waterproof Bluetooth Speaker resists dust and heavy rainfall. It’s currently available in the Boing Boing Store.The Trakk Bullet offers the same wireless convenience as other portable speakers, but few are built as tough as this one. Its utilitarian construction is designed to be a totally low-maintenance […]
The Ticwatch 2 Active Smartwatch is a simpler take on an active wearable that raised over $2m dollars on Kickstarter and is currently offered in the Boing Boing Store.Somewhere in between the single-day battery life and platform-specificity of the Apple Watch and Android Wear devices, there exists the Ticwatch. Instead of trying to shoehorn another […]
Loot Crate is a subscription service that delivers a box of curated pop culture goods to your doorstep. To sample their geeky wares, you can order a single mystery box exclusively from the Boing Boing Store.Each month Loot Crate sends you 6-7 unique items and apparel, including collectibles, books, and t-shirts. Pulling inspiration from all […]