Hacker News Reader

Comment by imglorp | Hacker News Reader

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

View on HN

Toyota ran an anti-distracted driving radio ad where they did this. The ad narrator says "Hey Siri, please turn airplane mode on." https://www.youtube.com/watch?v=NqZBVTMrgFA

That actually seems kind of dangerous. It could cause people to pull out their phones to check whether the ad actually turned airplane mode on.

Doesn't she say something about "okay, turning off" when that happens?

If you watch the video you see that the ad actually answers the warning prompt with "Yes" as well.

siri has itself trained to a single user's voice. I've never had anyone else's voice activate my phone with "Hey Siri". Admittedly, it usually takes me saying "Hey Siri" 3 times before it recognizes my voice, but I'm 100% certain a radio ad would get no response from my phone.

Just want to chime in and say that I can activate my girlfriends iPhone by saying "Hey Siri" in a girly sounding voice. It's trained to only her voice but I can trigger it. So it's not foolproof as you make it seem.

My wife's phone regularly (maybe once a month), starts listening in response to me saying something, which isn't even "Hey Siri", despite never training with my voice. My voice does not sound anything like my wife's.

So, I think the error rate is simply not low enough to make conclusive claims about what it might or might not do.

Better stock up on those tinfoils.

It happens to me many times a day. I've b come acutely aware of how much I question other people because it activates when I say "Are you serious?"

Siri is definitely not trained to a single voice. And yes, the car radio can turn it on. I've had a podcast discussion of Siri trigger it. It became such a joke that some podcasters have another phrase they say when they mean "hey Siri".

Since the iPhone 6S, Hey Siri is activated by a dedicated chip in the SoC. This enables low-power real-time detection of trigger words. Before, Hey Siri only worked with phones in the process of charging, because it was done with software, so a lot less efficient.

These voice-activated chips can be trained (as seen in a lot of other phones), but I'm not sure the software-powered Siri can be trained.

"Trained" is a bit of a joke with voice-activation. I've never seen it matter in practice.

I think Google does for android. I often ask "wake me up in 15 minutes". I've seen the phone write 50 and immediately switch to 15.

trained to a particular voice ~= trained to a user's preferences!

Doesn't "trained" in the context of voice recognition mean something more like "better able to understand your voice" and not "able to exclude other voices."

As a sample of the alternate term, Merlin Mann's assorted podcasts generally use "Ahoy Telephone."

It has only been a feature since iOS 9: http://9to5mac.com/2015/09/11/os-9-siri-voice-recognition-tr...

I have an acquaintance by the name of Siri, hilarity ensues.

It would only work if the iPhone was plugged into power AND they had turned on the capability for Siri to be activated by voice, which is limited to when the iPhone is plugged in.

I know Android users might not understand this limitation, but there it is.

The iPhone 6s, and the Apple Watch, are always listening (if enabled) for "Hey Siri", even on battery.

Fuck that shut.

If airplane mode is turned on and my GPS disabled as I'm close to the my right turn you better believe I'll be distracted.

A better solution would be a true hands free mode that prevented touch input from working while driving.

Does airplane mode disable the GPS? GPS is a passive receiving of radiowaves, so I'm guessing not?

(according to Apple, prior to 8.2 it did turn it off. https://support.apple.com/en-us/HT204234)

Directions require more than your satellite coordinates. Map services are frequently polling servers for traffic conditions, new tiles for the map, and so on. You'd hope that these can fall back gracefully but I wouldn't put it past them to not. If you activate airplane mode and disable your phone's cellular connection, even if your phone doesn't disable the GPS receiver, directions may stop working.

Works fine on my Android. I regularly lose cellular reception in the mountains, and it continues to work. Sometimes the tiles are low-res, but still readable. I would expect Apple would design around the same contingency, along with poor cellular service along more remote areas of the Interstate.

Android allows you to pre-save areas for offline use also, not sure if Apple does that. I don't have a mobile data plan on my phone, so if I need navigation, I just save the map area before I get off WiFi.

They do, although in my experience Google Maps is better at this. I actually find Apple Maps to be perfectly usable for everything, but always use Google Maps for directions to the boonies if I'm going hiking or something -- it's much better at caching tiles and keeping them around for directions back once I'm out there as well.

Yes offline maps is nice but the infuriating limitation is that it will save map tiles but not locations or areas that I've saved in "My Maps". One would expect a couple of coordinates to require much less storage than a bunch of map tiles...

There's almost no such thing as a passive radio anymore... superheterodyne receivers are the norm now and they contain a local oscillator that can leak back out into the airwaves.

https://en.wikipedia.org/wiki/Superheterodyne_receiver

Waze has a prompt that asks if you're a passenger while in motion for precisely this reason.

Similarly, I recall an Xbox One commercial with Aaron Paul which ended in him jumping onto his sofa and saying "Xbox on!"

...you can figure out what happened to anyone who already owned an Xbox One.

Xbox shut off trolling https://www.youtube.com/watch?v=xuGDhZorlQ0

Haha, watching the ad reminds me of the HAL shutdown scene from Space Odyssey

"I'm sorry Dave, I'm afraid I can't do that"

reminds me of this:

https://www.youtube.com/watch?v=R22WNkYKeo8

Children's advertisements did this in the 1980s in the US with pay-per-minute numbers. The ad would offer to connect children to Santa if they held a phone up to the television. DTMF -> 900 number -> profits.

Ha! True commercial phreaking. I love it.

People at NPR were joking later that they should just ask listeners' devices to send them money during a fund drive.

https://en.wikipedia.org/wiki/Soupy_Sales#New_Year.27s_Day_i...

> On January 1, 1965, miffed at having to work on the holiday, Sales ended his live broadcast by encouraging his young viewers to tiptoe into their still-sleeping parents' bedrooms and remove those "funny green pieces of paper with pictures of U.S. Presidents" from their pants and pocketbooks. "Put them in an envelope and mail them to me", Soupy instructed the children. "And I'll send you a postcard from Puerto Rico!"

This has been a running joke on the Verge's main podcast for the last few months. People have confirmed that "Hey Siri", "OK Google" "Hey Alexa" and "Hey Cortana" all work on their respective platforms when the hosts blurt them out, and can trigger various mischievous actions. And that's a podcast listened to by comparatively few people. Imagine the mayhem if someone were to do this on, say, the Super Bowl.

Lol. I just imagined a hilarious but possibly effective use case.

Imagine this happening in movie theaters during trailers.

"Hey Siri, turn off"

> Imagine the mayhem if someone were to do this on, say, the Super Bowl.

Imagine a pop star paying Apple to give their newest single free to everyone (a la Songs of Innocence), and then a 10-second Super Bowl ad that's just "Hey Siri, play ___" with a dancing silhouette.

That would be one hell of a Rick-roll.

I would not but it past reddit to crowd fund a superbowl ad that does exactly this. I know that I'd back it.

There was a Dilbert animation with Wally using a new voice-controlled interface. Dilbert comes up behind him and says "You know, it'd be a shame if this thing were to accidentally DELETE FILE!!!" and walks off.

http://dilbert.com/strip/1994-04-24

Better demonstration: https://www.youtube.com/watch?v=7MqhBL9eEts#t=1m14

I love the questions idea.

Surely someone's going to figure out a way to "talk" to Alexa in a pitch that it can hear but humans cannot?

But even if humans can hear the fraudulent commands, what's the defense beyond a confirmation?

The idea of this vector has been around for a while.

I recall an apocryphal story about a demo of a voice-controlled OS from the 1990s. The idea was that in the middle of this demo someone shouted out a sequence of destructive commands, like

"FORMAT C!", "YES!" (I'm sure)

"FILE", "DELETE", "NO" (Don't save)

Really wish I could find the original source.

Not the original source, but this is the joke, along with its real-world counterpart:

http://grumpytech.blogspot.co.uk/2007/02/joke-becomes-true.h...

Also, don't forget "Dear aunt, let's set so double the killer delete select all":

https://www.youtube.com/watch?v=2Y_Jp6PxsSQ

And of course Dilbert: http://dilbert.com/strip/1994-04-24

Like those radio ads which use police sirens in their background to catch your attention.

Or TV ads with Skype/Facebook notification sounds embedded in them for the same reason.

I've thought it would be interesting to ask everyone to shut off, or at least put their phones in airplane mode during a presentation... wait a minute then "OK Google find me penis pictures" or something similar for Siri...

The solution is simple: let every user choose a name for their assistant on setup.

:) - https://en.wikipedia.org/wiki/True_name#Folklore

>Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx". reply

You can change the default from alexa to something else.

Amazon.

Unless they've updated it since I installed mine, those were your choices.

Can you send a "donation" by text message using this?

Google Now takes the user's voice into account during setup and usually responds only to the user's voice. Such a system should have been implemented in Echo too.

The Echo is designed to be used by a whole family, and whatever friends you have visiting too (to control music). So that would be counterproductive.

Entertainingly, Alexa supports purchasing music, so one could release a song on Amazon music with audio that triggers Alexa to buy it.

Mine requires a PIN to purchase.

Whom are you fooling? There's a 50/50 chance your PIN is the same as the combination I use on my luggage. And if the PIN is also by voice, a picking a popular PIN will bypass the check for a good fraction of users, particularly if you get 3 tries or something.

"Alexa, cancel my health insurance"

"Alexa, call 911 to this address"

"Alexa, delete all my photos. Yes confirmed"

confused robo deputy

Reply on news.ycombinator.com