Hackers can hijack smart speakers using a laser pointer, researchers warn

Quote-en-quote “smart” speakers have a huge security flaw that allows them to be hacked with a run-of-the-mill laser pointer.

Hackers can hijack your smart speakers, unlock your doors and run up gas and electric bills at your home using laser pointers.

The terrifying attack uses a laser to control the speaker – like an Amazon Echo or Google Home – instead of words.

By changing a laser’s intensity to a certain frequency, researchers were able to trick the speaker into thinking it was hearing sound.

The laser would be pointed at the speaker’s microphone and interpreted as an audio command.

This lets hackers issue voice commands to your speakers, potentially at huge distances away.

“(It’s) an attack that is capable of covertly injecting commands into voice-controllable systems at long distances,” said the University of Michigan team in a research paper.

This would allow hackers to do anything you can normally do with a smart speaker.

Hackers could annoy you by playing loud music at night or making phony purchases on your account.

Amazon’s Alexa smart speakers are vulnerable to the hack.

But the attacks can get more serious if you have a smart speaker linked up to other smart home gadgets.

They could run up big gas or electricity bills using smart heating and lighting systems.

And users with smart door locking systems could be put at risk of burglaries.

Researchers were able to open a garage door using the hack.

The only requirement for the “LightCommands” hack is a reasonably sophisticated laser set-up and direct line of sight to the speaker.

But this could easily be achieved for reasonably low cost, with lasers aimed through a clear window.

Researchers also conducted tests on Google Home and Apple Siri-powered smart speakers.

All of the necessary gear can cost well under $750, making the attack worryingly simple to put together.

“The laser current driver with analog modulation port is the most specialised instrument in the attacker’s set-up,” researchers explained.

“We used the scientific-grade laser drivers that cost about $US1500 ($A2160).

“However, there are cheaper alternatives.”

The laser was bought online for around $26, the researchers said.

One way of spotting the attack is to look out for laser light on your speaker.

But that won’t always work – scientists were also able to execute the hack using invisible lasers.

You can’t always see the lasers.

The experiment worked with infra-red laser light that can’t be seen by human eyes.

In a statement given to The Sun, an Amazon spokesperson said: “Customer trust is our top priority, and we take customer security and the security of our products seriously.

“We are reviewing this research and continue to engage with the authors to understand more about their work.”

A Google spokesperson told us: “We are closely reviewing this research paper.

“Protecting our users is paramount, and we’re always looking at ways to improve the security of our devices.”

This article originally appeared on The Sun and was reproduced with permission