Security boffins say music could trigger mobile malware

Security researchers have discovered that specific music, lighting, vibrations or magnetic fields could all be used as infection channels to trigger the activation of mobile malware on a massive scale.
The paper, titled Sensing-Enabled Channels for Hard-to-Detect Command and Control of Mobile Devices, was presented in the eastern Chinese city of Hangzhou earlier this month by researchers at the University of Alabama at Birmingham (UAB).

The research describes at length how hard-to-detect non-internet channels can be used to trigger malware hidden in smartphones and other mobile devices from up to 55 feet away.

“When you go to an arena or Starbucks, you don’t expect the music to have a hidden message, so this is a big paradigm shift because the public sees only emails and the internet as vulnerable to malware attacks,” said UAB professor Ragib Hasan in a canned statement.
“We devote a lot of our efforts towards securing traditional communication channels. But when bad guys use such hidden and unexpected methods to communicate, it is difficult if not impossible to detect that.”
On the audio front, the report claimed that “command and control trigger messages” could be sent over 55 feet indoors and 45 feet outdoors, even using “low-end PC speakers with minimal amplification and low-volume”.
It speculated that malware could be activated with messages hidden in TV or radio programmes, background music and even musical greeting cards.
The light channel works best at night or in places with low illumination but could be relayed to a large number of devices and over “reasonably long distances” using large screen TVs, the report said.
The magnetic channel was described as having the shortest range although with the added advantage for the attackers of being able to work whether the device is being carried in the hand or inside a pocket.
“This kind of attack is sophisticated and difficult to build, but it will become increasingly easier to accomplish in the future as technology improves,” said UAB doctoral student Shams Zawoad, in a separate canned statement.
“We need to create defences before these attacks become widespread, so it is better that we find out these techniques first and stay one step ahead.”