A series of distorted voice commands surreptitiously hidden in YouTube videos can force unprotected Android or iOS smartphones to carry out malicious operations, researchers have discovered.
Controlling smartphones with voice commands was already done last year when two security researchers from French agency ANSSI have
used radio waves to send hidden commands to smartphones running Siri or Google Now. The attack was possible only if the phone had its headphones plugged in.
YouTube attack is simpler to carry out
A team of seven researchers from the University of California, Berkeley, and Georgetown University has devised a variation of this attack that uses mangled voice commands hidden in YouTube videos.
The attack works when the user is viewing a tainted YouTube video that contains hidden commands. He can view the video from his nearby PC, laptop, smart TV, tablet, or another smartphone.
