New Android attack: Google Voice Search attack

New Android attack: Google Voice Search attack

Researchers from the Chinese Emy of Hong Kong published a paper (PDF) on the website, introducing a novel method of Permission Bypass attack: Google Voice Search attack. Attackers can use VoicEmployer, a zero-Permission Android app, to activate Google Voice Search, a built-in Voice assistant module in the operating system, and play prepared audio files in the background, voice Search can recognize voice commands and perform corresponding operations. With this mechanism, attackers can call arbitrary phone numbers without any permission, forge text messages or emails, access private information, transmit sensitive data, and achieve remote control. Researchers believe that theoretically, any Android device with the built-in Google Services Framework may be affected by this attack.