UltraCommander: Ultrasonic Side Channel Attack via Browser Extensions

Ultrasound, imperceptible to the human ear, emerges as a potent carrier of information. Exploiting its covert nature, a growing number of both malicious entities and researchers delve into its potential privacy threats. Simultaneously, the surge in Browser Extensions, prized for their streamlined access to privileged browser resources, adds a layer of convenience while raising a big concern. This work introduces UltraCommander, a kind of cyber attack that leverages ultrasonic channel communication. In particular, UltraCommander covertly monitors user private data based on attacker-specified commands, facilitating surreptitious data transmission to the attacker. We then intricately detail the implementation of this attack and showcase its imperceptible nature. Our research underscores the successful exfiltration of private data through Chrome APIs, with future prospects extending to capturing additional information, such as SMS data, from browsers.