1
$\begingroup$

Most know that early phones and modems, and still, fax machines, sent information through the use of tones. This got me thinking - could audio be a viable vector for executing instructions by a bad actor? (By this I mean the use of a carefully crafted audio file that when played could trick some part of the OS or underlying hardware to execute actual machine code)

I imagine there are means to prevent this (I hope), but I'm unable to find any specific documentation or examples of this being considered, nor any defenses being placed into software or hardware.

This is quite a theoretical question, mostly born out of curiosity, and something I was hoping to find a study on, with no luck.

$\endgroup$
6
  • $\begingroup$ Can you please try to word your second sentence unmistakably? What is the meaning of vector and actor there? And what does prevent instructions being executed by audio mean? Ignore audible instructions? (Mine's "box". I'm confident it ignores "audio instructions", and almost sure about ones starting with "a lexer".) $\endgroup$
    – greybeard
    Commented Nov 7, 2021 at 21:17
  • $\begingroup$ So, I mean specifically, what keeps a malicious actor from using carefully crafted sound to execute instructions on the CPU itself? By this I mean, some kind of audio that is made specifically for the purpose of tricking some part of an OS / hardware into believing that it should execute actual lines of machine code? $\endgroup$ Commented Nov 7, 2021 at 21:55
  • 1
    $\begingroup$ Computers don’t work the same way as humans. If they’re not “listening”, they won’t “hear” anything. $\endgroup$ Commented Nov 7, 2021 at 22:10
  • $\begingroup$ I’m aware of that, this is mostly in regard to when audio is actually processed by either an on-board audio card or by software itself to play it. $\endgroup$ Commented Nov 8, 2021 at 1:22
  • 1
    $\begingroup$ Scientists jump the "air gap" with hidden acoustic networks (2013) $\endgroup$ Commented Nov 8, 2021 at 12:37

3 Answers 3

2
$\begingroup$

It already exists and we can find the examples with CVE mpeg or CVE mp3, or searching some other formats. Three examples among the many;

  • CVE-2014-2299
    Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. Publish Date : 2014-03-11 Last Update Date : 2016-06-02
  • CVE-2010-0480
    Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."
  • CVE-2010-0818
    The MPEG-4 codec in the Windows Media codecs in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly handle crafted media content with MPEG-4 video encoding, which allows remote attackers to execute arbitrary code via a file in an unspecified "supported format," aka "MPEG-4 Codec Vulnerability."
$\endgroup$
1
  • 1
    $\begingroup$ Changed yours to be the accepted answer as it carries a wealth of primary sources with it - thank you very much! $\endgroup$ Commented Nov 8, 2021 at 20:07
2
$\begingroup$

Yes, it absolutely could, if the software that plays the audio has a vulnerability that allows that to happen.

I suggest learning about the nature of these vulnerabilities, to understand better how it can happen -- and then you will see that it can happen with any data, if the software that interprets the data has the right (wrong) sort of vulnerability. You might start by reading about buffer overrun vulnerabilities and code injection vulnerabilities.

Without a vulnerability, no, that won't happen.

$\endgroup$
0
$\begingroup$

I'm far from a expert hardware engineer but hardware like old phones transmit sound with a range of frequency that's translated by some oscillating circuit. It is dead hardware that doesn't do anything except transmit current that makes a small speaker vibrate at a specific frequency which create sound. It doesn't really execute instructions like a processor would.

Nowadays, you have complex microphones which capture sound. There are complex controllers in the microphones probably which execute instructions but not CPU ones.

For example, on x86-64, a USB microphone is polled by an xHC. The xHC polls the microphone until it has data. The xHC doesn't execute CPU instructions but it can write in RAM directly. This is definitely a vulnerability but is the kind of attack that would require having a combined control of the computer and to be in range of the microphone AND a vulnerability in the hardware controller (the xHC). The xHC does write in data but at the demand of software. Since it is DMA, if the xHC writes in RAM at some position where it shouldn't then, it is an attack vector. I have a hard time to understand why some sound vs other would trigger this kind of attack. I also doubt that there is such vulnerability in USB controllers.

The biggest threat is probably software. Software is audited a lot but is known to have lots of bugs and vulnerabilities. Software could overwrite some part of itself by triggering DMA writes for example. That could drastically change the behaviour of software and be an attack vector.

Don't get me wrong though. The question is "Do modern computers prevent instructions executed by audio? If so how?". The answer is they don't have to because audio isn't executing instructions. There is a lot of hardware in between and even this hardware is DMA so it doesn't execute instructions. It writes in RAM directly so this is the vulnerability not that "audio executes instructions".

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.