Monkey Says, Monkey Does: Security and Privacy on Voice Assistants

TLDR

Smart mobile devices with sensors and voice‑controlled assistants have transformed user interaction, but recent evidence shows they pose significant security and privacy risks. This paper aims to demonstrate how voice‑assistant attacks can be launched and analyze their real‑world impact. The authors illustrate attack techniques and assess their effects in realistic scenarios. The study finds that voice‑assistant attacks are real, amplified by OS mechanisms, assistant capabilities, and IoT proximity, making them more dangerous than previously thought.

Abstract

The introduction of smart mobile devices has radically redesigned user interaction, as these devices are equipped with numerous sensors, making applications context-aware. To further improve user experience, most mobile operating systems and service providers are gradually shipping smart devices with voice controlled intelligent personal assistants, reaching a new level of human and technology convergence. While these systems facilitate user interaction, it has been recently shown that there is a potential risk regarding devices, which have such functionality. Our independent research indicates that this threat is not merely potential, but very real and more dangerous than initially perceived, as it is augmented by the inherent mechanisms of the underlying operating systems, the increasing capabilities of these assistants, and the proximity with other devices in the Internet of Things (IoT) era. In this paper, we discuss and demonstrate how these attacks can be launched, analysing their impact in real world scenarios.