# acoustic malware-is it real? **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [November 2, 2013, 1:15am UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895 "2013-11-02T01:15:55Z")\ **Posts on this page:** 12\ **Page:** 3
**Author:** ![Dog80](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@Dog80](https://boards.straightdope.com/u/Dog80)\ **Post date:** [November 5, 2013, 10:22am UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/41 "2013-11-05T10:22:27Z")
> [@aruvqan](#): > > What bothers me is the most recent update to most of the apps on my tablet included the \ - I don’t want something able to delete without my specific permission. I am considering returning my tablet to factory and removing my apps and very carefully selecting what goes on. I think I can get nonstandard music playing and book reading apps that won’t be able to screw around with my data without asking permission. Alternately, I can get my buddy Chris to write me some apps. Assuming it is an Android tablet, you can use [Permission Manager](https://play.google.com/store/apps/details?id=com.gmail.permissionmanager&hl=en) to change individual app permissions. But as **Finagle** said, access to storage is a common and essential permission, disabling it could stop the app from functioning. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [November 5, 2013, 2:54pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/42 "2013-11-05T14:54:41Z")
> [@astro](#): > > Even in the olden days of the early 80’s when this was actually a thing like in the acoustic modem cups used in the [TRS-80 Model 100 portable computer](http://en.wikipedia.org/wiki/TRS-80_Model_100) you had to use tightly sealed acoustic cups sealed to the earpiece of the phone and that was to get just 150 baud. That was the first thing I thought of; just how fast and reliably could two computers exchange via ultrasonic sounds in clear air? It sounds like BS to me; not only would the infected computer have to have the capability to send this sort of data, but the receiving one would have to have a microphone (strike one for many), it would have to be listening (strike two), and enough reliable data would have to be transferred to actually rewrite some portion of the BIOS (strike three). I’ll believe it when I see it. ---
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [November 5, 2013, 3:26pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/43 "2013-11-05T15:26:03Z")
One way I could imagine this happening is if computers have their microphones and speakers set up as an acoustic coupler modem. Last I checked, those went out by 1990 but the technology still exists. If there’s an OS out there that has “use speaker and microphone as modem if another modem is detected”, and it is not properly secured, then this might be feasible. But securing it would be as easy as disabling the modem. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [November 5, 2013, 5:01pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/44 "2013-11-05T17:01:35Z")
After thinking about it more, how would a passive computer know to listen for that particular set of data bits, parity, encoding, compression, etc… without having set that up ahead of time? If this sort of thing were true, it would almost certainly be by way of some sort of backdoor encoded by the manufacturers, or else there wouldn’t be any way for the receiving computer to actually receive and correctly decode it. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [November 5, 2013, 5:35pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/45 "2013-11-05T17:35:12Z")
Computer hardware and processing power is much better than it used to be. Think of those song identifying apps like SoundHound, they listen through a mic and identify a song based on the captured audio, even from crappy sources. Granted the actual song recognition processing is done on their servers via the Internet but offline voice recognition exists and works fairly well. ---
**Author:** ![eschereal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eschereal/32/18939_2.png) [@eschereal](https://boards.straightdope.com/u/eschereal)\ **Post date:** [November 5, 2013, 6:47pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/46 "2013-11-05T18:47:57Z")
> [@control-z](#): > > Computer hardware and processing power is much better than it used to be. Think of those song identifying apps like SoundHound, they listen through a mic and identify a song based on the captured audio, even from crappy sources. Granted the actual song recognition processing is done on their servers via the Internet but offline voice recognition exists and works fairly well. Yes, but does the computer do that spontaneously? Are you working along and suddenly “That sounds like Pearl Jam!” pops up in an alert? The first point is that ultrasonic acoustic data transfer is not a standard means of communication: your computer is not normally listening for an audio data stream through its mic, and standardized data transfer protocols for such a medium have not been established. The second point is that if it were listening and there were protocols, the method and vector for malicious code installation would have to be predetermined. In other words, your computer would have to be listening for ultrasonic data (unlikely) at a given frequency (less likely) and know how to handle it (unlikelier still) in a way that faulty data would result in an infection (vanishing unlikeliness). Find me the specific grain of sand you dropped on that beach three years ago and I will maybe begin to consider this paranoid fantasy. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [November 5, 2013, 7:09pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/47 "2013-11-05T19:09:00Z")
> [@bump](#): > > That was the first thing I thought of; just how fast and reliably could two computers exchange via ultrasonic sounds in clear air? Fast enough for a lot of damage, especially if you don’t realize it’s happening and leave them unattended overnight. > [@](#): > > [N]ot only would the infected computer have to have the capability to send this sort of data, but the receiving one would have to have a microphone (strike one for many), it would have to be listening (strike two), and enough reliable data would have to be transferred to actually rewrite some portion of the BIOS (strike three). The article mentions laptops. Nearly all laptops today are shipped with both microphones and speakers. Among desktops, many displays also contain built-in microphones and speakers. > [@robert\_columbia](#): > > One way I could imagine this happening is if computers have their microphones and speakers set up as an acoustic coupler modem. Last I checked, those went out by 1990 but the technology still exists. If there’s an OS out there that has “use speaker and microphone as modem if another modem is detected”, and it is not properly secured, then this might be feasible. But securing it would be as easy as disabling the modem. I’m not sure what you’re suggesting here, but since the BIOS is compromised, you can’t just disable anything without physically removing it. If there are speakers, you better cut the wire. There’s no reason this code would have to rely on any built-in modem capability. It’s just converting data to sound and sound to data. > [@Dog80](#): > > I find it hard to believe that there’s a single piece of code that can effortlessly jump from PC to Mac to BSD to Linux etc. It depends on how different the underlying hardware is. The difficulties of getting Mac OS to run on hardware that it wasn’t designed to run on are not relevant to how hard it is to write a BIOS or EFI-level virus. ---
**Author:** ![aruvqan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aruvqan/32/2891_2.png) [@aruvqan](https://boards.straightdope.com/u/aruvqan)\ **Post date:** [November 5, 2013, 7:28pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/48 "2013-11-05T19:28:44Z")
> [@Dog80](#): > > Assuming it is an Android tablet, you can use [Permission Manager](https://play.google.com/store/apps/details?id=com.gmail.permissionmanager&hl=en) to change individual app permissions. > > But as **Finagle** said, access to storage is a common and essential permission, disabling it could stop the app from functioning. I know, it is just the whole ‘delete’ that bothers me, I can see a bug or malicious act deleting the contents of my sd chip or hard drive of stuff that I can’t replace [I only sync it once a week] and I am still horrified with Amazon deleting a purchased book without any action by the owner … ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [November 5, 2013, 10:23pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/49 "2013-11-05T22:23:22Z")
> [@For You](#): > > Yes, but does the computer do that spontaneously? Are you working along and suddenly “That sounds like Pearl Jam!” pops up in an alert? > > The first point is that ultrasonic acoustic data transfer is not a standard means of communication: your computer is not normally listening for an audio data stream through its mic, and standardized data transfer protocols for such a medium have not been established. The second point is that if it were listening and there were protocols, the method and vector for malicious code installation would have to be predetermined. In other words, your computer would have to be listening for ultrasonic data (unlikely) at a given frequency (less likely) and know how to handle it (unlikelier still) in a way that faulty data would result in an infection (vanishing unlikeliness). Find me the specific grain of sand you dropped on that beach three years ago and I will maybe begin to consider this paranoid fantasy. The paranoid fantasy seems to be mostly of your own creation. Nobody is claiming that acoustics are being used as an infection vector. What is being theorized based on reported observations is that systems that were already compromised via some other method, apparently on a BIOS/hardware level, are communicating via acoustic methods. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [November 5, 2013, 11:36pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/50 "2013-11-05T23:36:18Z")
> [@Musicat](#): > > although it’s hard to imagine it not being heard by a nearby human, since computers speakers don’t have a wider audio range than human hearing. Actually, they do (or can). See my post #28. The output from my test was inaudible to my ears (being at 20-22 kHz) but was both broadcast and received perfectly well. That said, the speakers may well prove a limit in some cases–I have one system that would audibly buzz when playing a 20 kHz tone–but it works in some cases without a particularly special setup. In fact, I tested the speaker from my cell phone and it also worked just fine at ultrasonic frequencies. Of course, as everyone has said, the target machine must already be infected for this to be in any way feasible. ---
**Author:** ![Kenm](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@Kenm](https://boards.straightdope.com/u/Kenm)\ **Post date:** [November 6, 2013, 4:13am UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/51 "2013-11-06T04:13:12Z")
> [@For You](#): > > Can any contemporary Mac boot from a CD? I think Jaguar was the last system that came on CDs. Minor quibble, but the language in this story looks just a little bit off. They’ll [**boot from DVDs**](http://www.macworld.co.uk/macsoftware/news/?newsid=3475042), but apparently it’s slower than booting from flash drives and more complicated to make the DVD. I used a flash drive to boot and clean-install Mavericks. > [@](#): > > You may have noticed that I didn’t mention making a bootable install DVD. Though it’s possible to make one, I don’t recommend it. More and more Macs ship without a built-in optical drive; booting and installing from a DVD is very slow; and 8GB flash drives can be found for $10 or less. All this means that there’s just little reason to opt for a DVD anymore. ---
**Author:** ![Amblydoper](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@Amblydoper](https://boards.straightdope.com/u/Amblydoper)\ **Post date:** [November 6, 2013, 1:46pm UTC](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895/52 "2013-11-06T13:46:09Z")
Update: > **[Researcher skepticism grows over badBIOS malware claims](https://arstechnica.com/information-technology/2013/11/researcher-skepticism-grows-over-badbios-malware-claims/)** > > Peers have yet to reproduce the odd behavior infecting Dragos Ruiu's computers. No one has been able to confirm or reproduce his claims. [Previous page](https://boards.straightdope.com/t/acoustic-malware-is-it-real/672895.md?page=2)