First published: 28th February 2007
A number of security researchers have been investigating Vista’s improved speech recognition features and found they could create MP3 or other audio files which would cause Vista to delete files and visit arbitrary websites. Such files could be hosted on malicious websites or P2P networks, and activated when the victim PCs are expected to be unattended. The technique could be used to download and run attack tools in a sophisticated attack.
Microsoft downplayed the scenario, saying that the exploit is technically possible but unlikely to be much of a threat in practice. Unfortunately, this is exactly how Microsoft has described previous vulnerabilities that later became a big threat. It is not possible to perform privileged functions, such as creating a user, by voice commands alone because the UAC prompt does not accept voice input by default. Microsoft also said that speaker and microphone placement, audio feedback and clarity of diction would make the attack difficult. Expect hackers to be well–spoken in future.