On Tuesday, a group of computer security researchers at the University of Michigan and the University of South Carolina will demonstrate
that they have found a vulnerability that allows them to take control of or surreptitiously influence devices through the tiny accelerometers that are standard components in consumer products like smartphones, fitness monitors and even automobiles.
“It’s like the opera singer who hits the note to break a wine glass, only in our case, we can spell out words”
and enter commands rather than just shut down the phone, said Kevin Fu, an author of the paper, who is also an associate professor of electrical engineering and computer science at the University of Michigan and the chief executive of Virta Labs, a company that focuses on cybersecurity in health care.
In testing 20 accelerometer models from five manufacturers, they affected the information or output from 75 percent of the devices tested
and controlled the output in 65 percent of the devices.
And in 2011, a group from the Massachusetts Institute of Technology
and the Georgia Institute of Technology demonstrated the use of an accelerometer in a smartphone to decode roughly 80 percent of the words being typed on a nearby computer keyboard by capturing vibrations from the keyboard.
In their paper, the researchers describe how they added fake steps to a Fitbit fitness monitor
and played a “malicious” music file from the speaker of a smartphone to control the phone’s accelerometer.
It’s Possible to Hack a Phone With Sound Waves, Researchers Show -
By JOHN MARKOFFMARCH 14, 2017
SAN FRANCISCO — A security loophole that would allow someone to add extra steps to the counter on your Fitbit monitor might seem harmless.
If an accelerometer was designed to control the automation of insulin dosage in a diabetic patient, for example,
that might make it possible to tamper with the system that controlled the correct dosage.