The radical advances in telecommunications and computer science have enabled a myriad of applications and novel seamless interaction with computing interfaces. Voice Assistants (VAs) have become a norm for smartphones, and millions of VAs incorporated in smart devices are used to control these devices in the smart home context. Previous research has shown that they are prone to attacks, leading vendors to countermeasures. One of these measures is to allow only a specific individual, the device's owner, to perform possibly dangerous tasks, that is, tasks that may disclose personal information, involve monetary transactions etc. To understand the extent to which VAs provide the necessary protection to their users, we experimented with two of the most widely used VAs, which the participants trained. We then utilised voice synthesis using samples provided by participants to synthesise commands that were used to trigger the corresponding VA and perform a dangerous task. Our extensive results showed that more than 30\% of our deepfake attacks were successful and that there was at least one successful attack for more than half of the participants. Moreover, they illustrate statistically significant variation among vendors and, in one case, even gender bias. The outcomes are rather alarming and require the deployment of further countermeasures to prevent exploitation, as the number of VAs in use is currently comparable to the world population.

翻译：电信与计算机科学的飞速发展催生了大量应用，并实现了与计算界面的新型无缝交互。语音助手（VA）已成为智能手机的标配，而智能设备中集成的数百万语音助手被用于智能家居场景中的设备控制。已有研究表明，语音助手易受攻击，促使厂商采取应对措施。其中一项措施是仅允许设备所有者（即特定个体）执行可能危险的任务——例如泄露个人信息、涉及金融交易等操作。为探究语音助手为用户提供必要保护的程度，我们选取了两种最主流的语音助手进行实验，并由参与者对助手进行训练。随后，我们利用参与者提供的语音样本，通过语音合成技术生成指令，触发相应语音助手执行危险任务。大量实验结果表明，超过30%的深度伪造攻击成功，且半数以上参与者至少遭遇一次成功攻击。此外，不同厂商间的攻击成功率存在统计学显著差异，甚至在一例案例中显现出性别偏差。鉴于当前全球在用的语音助手数量已接近世界人口总数，这一结果令人担忧，亟需部署更多防护措施以防止此类利用漏洞的攻击行为。