An Attack on a Text-independent Speaker Authentication System

We mount an effective attack on a third-party open-source text-independent speaker verification system. Specifically, we show how an attacker can simply use a signal generated at fixed frequency to pass speaker verification and gain access to other user accounts. We demonstrate this attack on the GMM-UBM based ALIZE speaker verification system using the YOHO voice database. We show through experimentation that the attacker can impersonate any users in the database of 69 people with about 25% success rate with only 5 trials. The success rate can achieve more than 50% by increasing the allowed authentication attempts to 20. These success rates are significantly higher than the rates achievable by exploiting the false positive rate of the speaker verification system using random trials.