For now, staying safe on a mobile phone is about as easy as staying safe on a desktop computer: Avoid strange emails and websites, and don't download anything that looks suspicious. That could change, though, if hackers figure out how to leverage smartphone sensors for sound, light and vibration.
Imagine a crowded nightclub with hundreds of tightly packed dancers. All of sudden, a new song comes on, featuring a deep, throbbing bass line. Flickering lights flash in time with the beat. All of a sudden, everyone’s smartphones go crazy, lighting up and transmitting the owners’ private data to servers in Russia.
That's completely possible, according to a recent study from the University of Alabama at Birmingham that finds smartphones are vulnerable to what researchers dub "context-aware" attacks. These attacks could activate malware via sound-based, magnetic or visual stimuli.
Although hackers would not be able to transmit malware via context-aware attacks, they could take advantage of software already installed on users' phones. The process would be comparable to planting a sleeper agent in a foreign country who "activates" with a key phrase, just like in popular spy novels and movies.
Context-aware attacks may not sound too dangerous at first, considering they can’t be spread via the Internet and, therefore, have a limited area of effect. However, targeting phone sensors directly also makes context-aware attacks virtually untraceable because there is no easy way to track them back to a source.
If hackers hijack a popular broadcast frequency (such as a satellite radio or cable TV channel), they could theoretically activate malware on devices across a wide swath of territory, even crossing international borders. Most smartphones are so sensitive to sound and vibration that even when safely holstered in a bag or pocket, they still would be vulnerable to attack.
In order to test a smartphone's susceptibility to sound-based attacks, researchers installed imitation malware on Android handsets and set up a data message that they broadcast through moderately powerful wall-mounted speakers (like ones that might be found in a home audio system). The phone successfully received the message in a small room, across a 55-foot hallway and even outdoors across 45 feet of background noise.
Most smartphones also contain light sensors. (That’s how your phone can adapt to low- or high-light conditions, which is why it looks different in a dark room or in direct sunlight.) The researchers found that phones were receptive to messages sent via Morse -code-style flickering lights, including standard overhead lights and LCD TVs. [See also: 7 Security Spring Cleaning Tips ]
Any smartphone with an accelerometer also includes some magnetic machinery. When they exposed smartphones to a sensitive electromagnet, researchers discovered they could induce the phone to open a preinstalled malicious app. However, the process only worked at a maximum distance of 3.5 inches, so this style of attack would be most effective against individual users.
To hackers, the primary drawback of context-aware attacks is that they rely on users having malware already installed — knowingly or unknowingly — on their phones. However, an enterprising hacker could get over this hurdle by engineering a popular app (like a game or social networking tool) that contains hidden malicious software.
Another ambitious plan of attack would be to compromise a high-profile app like Facebook, which most smartphone users already possess. Android phones would be particularly vulnerable to such a hack, as installing programs and updates from unverified sources is not prohibited.
Although spreading malware via context-aware channels relies heavily on external factors (like whether users are in the targeted location or tuned into the appropriate channel), these attacks could cause a lot of trouble. Imagine a context-aware attack in an airport, for example, or at a major tech conference.
So far, there is no evidence that hackers have ever developed context-aware attacks, but a few might be inspired by the recent research paper. With any luck, the hackers in question will be security experts or academics rather than cybercriminals.
Follow Marshall Honorof . Follow us , on Facebook or on .