San Francisco (CNN Business) Usually you have to talk to voice assistants to get them to do what you want. But a group of researchers determined they can also command them by shining a laser at smart speakers and other gadgets that house virtual helpers such as Amazon's Alexa, Apple's Siri and Google's Assistant.

Researchers at the University of Michigan and Japan's University of Electro-Communications figured out they could do this silently and from hundreds of feet away, as long as they had a line of sight to the smart gadget. The finding could enable anyone (with motivation and a few hundred dollars' worth of electronics) to attack a smart speaker from outside your house, making it do anything from playing music to opening a smart garage door to buying you stuff on Amazon.

A Google Home smart speaker photographed on a kitchen counter, taken on January 9, 2019. (Photo by Olly Curtis/Future via Getty Images)

encoded in the intensity of a light beam, Daniel Genkin, a paper coauthor and assistant professor at the University of Michigan, told CNN Business on Monday. The light would hit the diaphragm built into the smart speaker's microphone, causing it to vibrate in the same way as if someone had spoken that command. In a new paper , the researchers explained that they were able to shine a light that had a command encoded in it (such as "OK Google, open the garage door") at a microphone built into a smart speaker. The sounds of each command wereencoded in the intensity of a light beam, Daniel Genkin, a paper coauthor and assistant professor at the University of Michigan, told CNN Business on Monday. The light would hit the diaphragm built into the smart speaker's microphone, causing itto vibrate in the same way as if someone had spoken that command.

A list of devices that the researchers tested and said are vulnerable to such light commands includes Google Home, Google Nest Cam IQ, multiple Amazon Echo, Echo Dot, and Echo Show devices, Facebook's Portal Mini, the iPhone XR, and the sixth-generation iPad. Smart speakers typically don't come with any user authentication features turned on by default; the Apple devices are among a few exceptions that required the researchers to come up with a way to work around this privacy setting.

Read More