Hackers can turn your phone into a sonic weapon
Headphones and other devices can be hacked to emit ultrasonic frequencies that could damage hearing, an expert said
The neighbour’s sound system and the headphones of a fellow train passenger can be annoying, but what if they could be taken over by hackers and turned into weapons?
It’s not beyond the realms of possibility, according to a security researcher who has found that gadgets such as phones, laptops and speakers can be hacked to emit deafening and disorientating sounds.
Matt Wixey, head of cybersecurity research for PWC, the professional services company, found that there was little to stop many devices from being turned into sonic weapons.
He claims to have designed software that makes the speakers in popular devices emit inaudible ultrasonic frequencies or audible sounds at a very high volume. This can damage hearing, cause tinnitus and have psychological effects.
Speaking at the annual Def Con hacking conference in Las Vegas, Mr Wixey said that he had found the vulnerability in smartphones, laptops, headphones, a PA system and different types of speakers.
“Some attacks used known vulnerabilities in a particular device, which could be done locally or remotely in some cases. Other attacks would either require proximity to the device or physical access to it.”
He added that one smart speaker attacked in this way generated enough heat to start melting the insides of the device after five minutes, causing permanent damage. Mr Wixey said that he had informed the manufacturer and that the company had issued a method to stop it.
In another experiment Mr Wixey scanned local wifi and Bluetooth networks for vulnerable speakers that could be taken over. Any device would then be made to play the combined loud noise.
Mr Wixey said that hackers could launch a sonic attack on the public by taking over several speakers at once. He told Wired magazine: “We were only scratching the surface and acoustic cyberweapon attacks could potentially be done at a much larger scale using something like sound systems at arenas or commercial PA systems in office buildings.”
Defence forces are already known to use sound weapons as a way to ward off crowds or enemies.
The US Navy uses a device that fires a beam of 150 decibels of noise as far as 300m to ward off pirate ships while sailing through the waters off the coast of Somalia.
In Israel the army has a sonic blaster that can shoot repeated pulses of sound at crowds, leaving them dizzy and nauseous. Sonic weapons made headlines in 2017 when it was claimed that audio attacks were making American diplomats ill at their embassy in Havana.
Manufacturers could introduce measures to help prevent sound attacks, Mr Wixey said. He suggested that companies limit the frequency range of their speakers so that they cannot emit inaudible sounds.
Laptops and phones could issue alerts if their speakers were in use without physical input or if apps were seeking permission to control the volume. Antivirus software could also include tools to look for suspicious audio activity.
Other researchers have found similar evidence of the dangers of speakers being hacked. Vasilios Mavroudis, of University College London, found that most commercial speakers could produce “near-ultrasonic” frequencies, which are sounds inaudible to humans but that do not qualify as ultrasonic.
Last year researchers from American and Israeli universities discovered that hackers could work out what someone’s computer screen was showing by listening to and analysing the ultrasonic sounds emitted by the monitor.
