According to a recent article in Information Week the speech recognition feature in Microsoft's new OS, Windows Vista, contains a major security flaw. Apparently, pranksters were able to execute commands on a PC from a remote location through the use of audio files hosted on a website. For example, the audio file can say shut down, copy and delete and these commands were executed by the PC. There were even some reports that a person was able to create a recording that downloaded and executed a file from the Internet. Now that can be scary!
While Microsoft downplays this flaw it clearly shows that a PC running Windows Vista (with the speech recognition feature activated) is highly vulnerable. Thus far, Microsoft has not offered a security advisory in regards to this flaw but user groups are suggesting Vista users to change the settings so the speech rec feature does not automatically load when the OS boots. The security flaw can easily be remedied with education and a simple adjustment of the OS settings. I think the larger impact is that this sheds light on the vulnerability and power of voice applications and, as a result, more pranksters and fraudsters will be attracted to the relatively untapped area of voice applications. This can potentially lead to an uptick in vishing attacks, as well as an increase in the number of attacks on corporate voice applications.
The article can be found on http://www.informationweek.com/showArticle.jhtml;jsessionid=HEVAEGZT4AK2...