Turning It Up To 11?

screech2So WIRED is currently running a story with the alarming all-caps headline HACKERS CAN TURN EVERYDAY SPEAKERS INTO ACOUSTIC CYBERWEAPONS – which puts it only a few exclamation marks short of the kind of full conspiracy-theory click-bait trash-dump you’d usually find on Infowars or Above Top Secret (not linking these because, you know, reasons). You’d be forgiven for thinking that the end is nigh in the form of an aural evisceration comparable only to the head-exploding scene in David Cronenberg’s Scanners. WIRED’s headline was one of the tamest for this story as it happens. The India Times pitched it as This next-gen ‘weapon’ is sitting in your room and you don’t even know (at least they eschewed the caps); Channel News ran with RESEARCHERS WARN OF HACKERS WEAPONISING SPEAKERS; and TechRadar breathlessly proclaimed that Your smart speaker could be transformed into an acoustic cyber-weapon by hackers. There were dozens more. Without exception, they all invoke a sense of cataclysmic acoustic terrorism that is extremely worrying.

So, what’s the story? Are we all in danger of suddenly and unexpectedly having our ears literally pierced with cybernetically honed shards of ultrasound, or our bowels emptied with undulating pulses of infrasound? Not so much. The gist of the story is that Matt Wixey, a researcher at a UK technology consultancy firm, made a presentation a few days ago at the hacking conference Defcon in which he demonstrated some software exploits that were capable of causing a variety of speakers to do things for which they weren’t designed.

“…the upshot of it is that the minority of the devices we tested could in theory be attacked and repurposed as acoustic weapons.”

The words to be noticing there are ‘minority‘ and ‘in theory’, because, as we shall see, the more we examine the language used in this article, the further we get away from the apocalyptic headlines that are blazing across the internet.

The first claim to which we might take exception is in the very first paragraph:

“researchers have long known that commercial speakers are also physically able to emit frequencies outside of audible range for humans”

‘Long known’? Really? Well, this does come as news to me, but I suppose it’s possible. Let’s check the citation… Oh guess what? There isn’t one. This is a common problem with pop science articles; a baseless claim, with not a whiff of any supporting reference, is used as the lynch-pin of a spurious argument. I spent ten minutes or so trying to dig up information on this ‘long known’ research and came up with nothing. Perhaps it’s long known, but if so, it certainly isn’t well-known. YMMV, but I think this falls into the category of ‘I’m sure I read it somewhere…’

Let’s deconstruct it anyway. The term ‘commercial speakers’ is misleading and broad. We could put everything from personal ear pieces, through laptop & phone speakers, to tv speakers, car speakers, PA systems, high-end hifi and a host of other things under that floppy metric. Is it reasonable to suggest that all those units could ‘emit frequencies outside of audible range for humans‘? Well, that’s compounding the vagueness by introducing another floppy metric. Most commercial-use audio speakers are, by convention, rated at a frequency response of 20Hz-20kHz. These frequencies represent the very extremes of the aural spectrum that humans can detect at the peak of their hearing capabilities, which, for most people, is around the age of 20. As you pass that age, your hearing goes into decline. If you’re in your mid twenties or later, then literally all commercial speakers are already reproducing frequencies outside your range of hearing. So a claim like that is completely specious in a fundamental way.  Here are some graphs showing typical hearing loss in humans due to the ageing process. The top ends of these graphs (like most audiograms) don’t even bother to go as high as 20kHz, because few people can hear frequencies anywhere near that even under optimal conditions. For typical human hearing, you can plainly see that by about age 35, hearing in both men and women is attenuating significantly in the higher frequencies. No-one at age 35 is hearing all the frequencies reproduced by a good speaker.

hearing4

For the purposes of argument, though, let’s just assume you’re 19 again and have perfect technical human hearing of 20Hz-20kHz; is it possible that ‘commercial speakers’ are capable of reproducing frequencies higher or lower than that? Well, the answer is: some, maybe, a bit. What you need to know is that, for the most part, the electronics of most amplification systems that drive speakers clamp (or bandwidth-limit) the frequency outputs to that range. Why? Because it’s simply energy-inefficient to reproduce frequencies that are outside the conventional speaker specifications. You’d be wasting power that could be better used elsewhere, or not at all.

Certain kinds of small speakers (like earbuds and computer speakers) might conceivably be capable of reproducing frequencies higher than 20kHz – it’s certainly technically possible. These frequencies are known by convention as ultrasound and it’s feasible that sloppy circuit design might allow such frequencies to pass from the amplification electronics to the speaker, or that a hacker might be able to trick the electronics into generating those kinds of frequencies. Even if this could happen, though, the pertinent question in respect of the ‘acoustic cyber weapons’ of our headline is whether or not it might be of any concern. We’ll look at that in a bit.

So far, I’ve been talking for the most part about high frequencies, but what about the lower part of the range of human hearing – frequencies lower than 20Hz? These are designated as infrasound, and in cyber-weapon banter, are the realm of the infamous Brown Note. Could ‘commercial speakers’ generate anything that could be considered infrasound? Again, some, maybe, a bit. Should you be worried? Short answer – no, but again, we’ll look at exactly why in few moments.

Let’s go back to the WIRED article. Wixey tested a variety of speakers ‘including a laptop, a smartphone, a Bluetooth speaker, a small speaker, a pair of over-ear headphones, a vehicle-mounted public address system, a vibration speaker, and a parametric speaker’, and found that:

…the smart speaker, the headphones, and the parametric speaker were capable of emitting high frequencies that exceeded the average recommended by several academic guidelines. The Bluetooth speaker, the noise-canceling headphones, and the smart speaker again were able to emit low frequencies that exceeded the average recommendations.

There’s a little bit of disingenuousness here. The language is imprecise and obfuscatory. The frequencies ‘exceeded the average’? That’s hardly surprising – an average is an average. You would expect some frequencies to exceed the average! And which academic guidelines? For what, exactly? Smart speakers, headphones, parametric speakers and noise-cancelling headphones are very different beasts, with very different capabilities and very different modes of sonic delivery. Are we talking about some blurry and generic ‘average’ of all possible speakers? Or an ‘average’ of certain selected speakers? Or ‘average’ hearing safety levels (and if so, under what circumstances)? It’s impossible to know, and as becomes obvious by this point in the article, we’re not going to get any cited papers or sources to clarify these extremely diffuse terms.

But again, let’s just give Mr Wixey the benefit of the doubt and speculate that – rather than his tests demonstrating that he was able to exceed the average specs of generic and unidentified speakers and/or listening conditions – he was able to hack the systems to have the units generate frequencies that exceeded the maximum agreed safe levels for human hearing. Should that be of any concern to us as consumers going about our daily lives? Is the Acoustipocalypse predicted by the headlines really upon us?

Not so much. It’s all about power.

Let’s consider the question: “If I wanted to make a sonic weapon, could I?” The Wikipedia entry for Sonic Weapons gives a précis of the landscape that’s pretty representative of anything you’ll find via a search on the rest of the net; it contains a lot of speculation, but not much content. The territory of possibilities that the entry offers covers things like high frequency sound used to deter teenagers from loitering around shopping centres, to long-range acoustic hailing devices used (in one single instance given) to deter pirates. There’s some conjuring up of infrasound as an explanation for a ‘haunted’ laboratory1 and an assertion that ‘High-amplitude sound of a specific pattern at a frequency close to the sensitivity peak of human hearing (2–3 kHz) [sic]2 is used as a burglar deterrent.’ 

And really, those things make up the bulk of the entry, and read like they’ve been written by someone desperately trying to make a case. Nothing there comes under the definition of ‘weapons’ in my opinion. Deterrents, perhaps. Weapons, no.

There’s a smattering of examples of things that could be considered actual weaponry, and they are all devices that generate ‘Extremely high-power sound waves [that] can disrupt or destroy the eardrums of a target and cause severe pain or disorientation.’ That is, devices that make exceptionally loud (and usually highly-focussed) noises – because that’s what they’re designed to do. There are no examples given of actual real world weapons that use infrasound or ultrasound.3

So yes, I could make a sonic weapon, but it would require significant amounts of power, and I wouldn’t bother with frequencies outside those of normal human hearing. I certainly wouldn’t consider using a smart speaker as my starting point.

The idea that power is an important factor in this story is actually hinted at in the WIRED recounting of Matt Wixey’s presentation, if you know what to look for. At one point in the article we learn that:

…attacking the smart speaker in particular generated enough heat to start melting its internal components after four or five minutes, permanently damaging the device

What you’re meant to infer here is, of course, that the infrasound/ultrasound audio energy is so impressively terrifying that it has melted the very speaker itself. No-one actually says that, however, and I strongly suspect that there’s something else at play here, which involves Mr Wixey and his hacking team attempting to get enough power out of the amplification electronics (probably in an effort to generate some impressive decibel figures to bolster their argument), that they overheated the circuitry. People who have spent enough time in the audio business are keenly familiar with this situation – if you run an amplifier too hard, you overheat its electronics. I’ll be the first to agree that a hacker shouldn’t be able to do this kind of thing, but that’s a different kind of problem entirely to making the speaker into a ‘cyber weapon’.

It’s revealed further into the WIRED piece that  Wixey & co didn’t/couldn’t perform any of their hacks remotely:

Wixey wrote simple code scripts or slightly more complete malware to run on each device. An attacker would still need physical or remote device access to spread and implant the malware.

You see how the image of intimidating cyber weaponry hacktivism promoted by the screaming headlines becomes less and less impressive as the article proceeds?

The most charitable take we could give on this story after throwing some rational appraisal at it, is that hackers might, in some cases (like when they’re actually in the same room), be able alter some speakers and cause them to do unpredictable things, such as making unexpected or loud noises or perhaps failing completely. It might also be possible for them to generate some high or low frequencies outside the recommended speaker specs, that could be of concern if it was first established that: such frequencies have deleterious effects on humans, that such an effect could be usefully controlled and that there was sufficient available power in any particular device to cause such frequencies to be strong enough to be dangerous and thus constitute a ‘weapon’. The WIRED article does not lead us to believe that Matt Wixey demonstrated such a scenario to be plausible.4

I’d be prepared to wager that the best that a hacker could currently do with this kind of exploit is to attract the attention of your dog or your pet elephant.5

To be fair, causing speakers to make sudden loud noises could certainly be startling, disorienting, or, in the case of earbuds that are placed in your ear canal (right next to your eardrums), even cause pain or hearing damage. As far as smart speakers or your computer speakers are concerned, though, it’s literally impossible for them to make a noise that is louder than the maximum level that the inbuilt amplifier can create – which is not really that loud, all things considered, and nothing that couldn’t be fixed by killing the power or shoving your device under a mattress. In any case, for this kind of thing to be considered a hacking cyber weapon, I’d expect to see at least some demonstration of a remote hijacking capability. If the hackers require direct physical access to your speakers in order to alter them, then it’s a bit like suggesting that someone who can tamper with the brakes on your car is turning it into a cyber weapon.

Adding in all the palaver about ultrasound and infrasound is nothing more than the invocation of  the bogey-man to spice up what would otherwise be a vaguely-interesting but ultimately pretty inconsequential Defcon presentation. Because research is scant and equivocal when it comes to the effects of what I’ll call ‘extrasound’ on humans, and because the general public doesn’t really know much about what these things actually are, they have become placeholders for all kinds of misleading speculation and pseudoscience.And seriously, there are enough real-world problems to be concerned about right now without pop-tech outlets like WIRED adding extra dollops of neurosis to the churn.

By all means keep us informed that researchers like Matt Wixey are alerting us to the vulnerabilities of modern tech, but let’s just stop with the hyperbolic End Times panic schtick.


1Personally, if I was concerned about credibility in an article concerning science, I wouldn’t list a ‘paranormal investigator’ as a reference in my Wikipedia entry.

2There’s something hideously wrong with this sentence. What exactly is the ‘sensitivity peak’ of human hearing, with that appended figure of ‘2-3 kHz’? Does the sentence simply mean (as I suspect it does) ‘a loud, high-pitched warbling noise’, and if so, why not just say that? And why say ‘close to’ a range of frequencies? Surely, if there’s a range, you just include your frequencies in that range? It’s such a nonsensical piece of writing, and is plainly something conceived by a marketing department. [After thinking on this for a bit, I realised that this describes exactly the sound that my house alarm makes. The system has some transducers inside the house, as well as sirens on the outside. The aim of the interior transducers is to make a loud, screaming warble for the sole purpose of startling any would-be intruder. I’d estimate the frequency of the sound to range between 1-3kHz. w00t! I have a sonic weapon in my house!]

3The Wikipedia entry asserts that ‘Some sonic weapons are currently in limited use or in research and development by military and police forces…’ and ‘make a focused beam of sound or ultrasound‘, but no actual examples or references are given. Any citations throughout the piece that refer to infrasound or ultrasound are generic definitions, speculations or simply irrelevancies. Any of the devices mentioned in the entry that are actually in practical use (for the purposes of crowd control, for example) merely make very loud sounds within the normal spectrum of human hearing. As the Mythbusters demonstrated some years back, when examining the myth surrounding the ‘Brown Note’, infrasound is highly difficult to control, uses a great deal of power and is almost impossible to make directional. It makes for a very poor weapon.

4The WIRED article does quote Professor Timothy Leighton, a researcher at the University of Southampton, who has a published paper in the The Journal of the Acoustical Society of America on the Effects of very high-frequency sound and ultrasound on humans. Professor Leighton et al completed a small study in 2018 which they claim shows mild indications of adverse effects on humans due to ultrasound exposure, but I think we should be cautious about their conclusions. The experiment involved a small sample group of about 50 people and showed a very slight result that wholly relied on statistical P values (a mode of scientific measurement that has been called into question in recent times) to claim significance. Of more concern, the study contained high levels of subjectivity and there was (as far as I can determine from the online version of the paper) no blinding and no control. Subjective metrics used to gather data were vague and open to interpretation (‘inability to concentrate’ for example). The one objective physiological component of the experiment – a measurement of galvanic skin response – did not support the subjective reports, or the researchers’ conclusion.

In addition, the way that certain parts of the paper are worded, and the unusual manner in which participants in the experiment were chosen, gives the distinct impression that the experimenters are starting from a position of an already-existing belief in the harmful effects of ultrasound.

Overall, it’s a poorly-conceived test, and we’d need to see something with much better protocols. many more participants and a much more persuasive data set to draw valid scientific conclusions.

5Dogs can hear ultrasonic frequencies, and elephants can detect infrasound.

6This is clearly evident if you spend even a little time on the web searching for ultrasound or infrasound weapons. It’s a landscape free from rationality, and rife with conspiracy theory and pseudoscience.