  Voice assistants like Siri enable us to control IoT devices conveniently with
voice commands, however, they also provide new attack opportunities for
adversaries. Previous papers attack voice assistants with obfuscated voice
commands by leveraging the gap between speech recognition system and human
voice perception. The limitation is that these obfuscated commands are audible
and thus conspicuous to device owners. In this paper, we propose a novel
mechanism to directly attack the microphone used for sensing voice data with
inaudible voice commands. We show that the adversary can exploit the
microphone's non-linearity and play well-designed inaudible ultrasounds to
cause the microphone to record normal voice commands, and thus control the
victim device inconspicuously. We demonstrate via end-to-end real-world
experiments that our inaudible voice commands can attack an Android phone and
an Amazon Echo device with high success rates at a range of 2-3 meters.
