Slashdot Mirror
Hackers Can Turn Amazon Echo Into a Covert Listening Device (helpnetsecurity.com)
Orome1 shares a report from Help Net Security: New research released by MWR InfoSecurity reveals how attackers can compromise the Amazon Echo and turn it into a covert listening device, without affecting its overall functionality. Found to be susceptible to a physical attack, which allows an attacker to gain a root shell on the Linux Operating Systems and install malware, the Amazon Echo would enable hackers to covertly monitor and listen in on users and steal private data without their permission or knowledge. By removing the rubber base at the bottom of the Amazon Echo, the research team could access the 18 debug pads and directly boot into the firmware of the device, via an external SD card, and install persistent malware without leaving any physical evidence of tampering. This gained them remote root shell access and enabled them to access the "always listening" microphones. Following a full examination of the process running on the device and the associated scripts, MWR's researchers investigated how the audio media was being passed and buffered between the processes and the tools used to do so. Then they developed scripts that leveraged tools embedded on the device to stream the microphone audio to a remote server without affecting the functionality of the device itself. The raw data was then sampled via a remote device, where a decision could then be made as to play it out of the speakers on the remote device or save the audio as a WAV file. The vulnerability has been confirmed to affect the 2015 and 2016 editions of the device. The 2017 edition of the Amazon Echo is not vulnerable to this physical attack. The smaller Amazon Dot model also does not carry the vulnerability. More technical details can be found here.
This is like saying that hackers can turn a car into a transportation device.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
"Amazon Echo still a covert listening device"
How many average consumer devices can't be compromised with physical access to the hardware?
Couldn't someone also just plant a bug in the thing (or somewhere else in your house) and listen to you that way?
In what world is this news?
Always listening device,
Who in their right mind thought these tools would be useful to a consumer? Are people out there really that dense to think that a device like this isn't sending every waking minute of their lives to some spook at the NSA?
Every time I hear someone go on and on about how the "Internet of Things" is the next great land rush, I laugh. The sooner this and 360 VR die the better.
If hackers turn all mobile phones into global echolocation surveillance system, that is going to be way more interesting. Do you ever ask yourself how google gets information about traffic jams? Every mobile phone is being tracked. What is the point to hack Amazon Echo when we have mobile phone in every pocket?
Star Trek had it right. First you poke the button on the communicator, then it listens...
I'm sorry. Unless you are asking for the weather or need a light turned on I don't know what you want.
No Shit Sherlock.
Back in '90 or I was sysadmin when we got a bunch of personal Sun workstations. These all had microphones on them, Usenet soon told me how to turn the mic on and record to a local file. Went to my boss, told him we needed to open up every box and cut a wire. He was all like "um, no, not gonna happen". Told him to wait 5 minutes, then call someone and talk for a minute or two. Went into his office, played back the audio file I'd recorded of his conversation, spent the next few hours opening up brand spanking new Sun workstations to cut a wire.
Why yes, I do have black tape over the camera on my laptop. Why do you ask?
While yes, physical access to a device means it *can* be hacked, there are different degrees of concern you should have, depending on the device in question.
For example, physical access to my car in order to hack it? The car does have door locks on it as well as requiring a separate key to actually start it. Most people have a habit of doing some basic physical security with their car - such as putting it in a garage at night (which is also locked), or at least locking it up and taking the keys with them whenever they leave the vehicle. Most paid parking lots or garages are attended too, or at least have security cameras operating. That means the bar is raised a bit for hacking into it.
Same with physical access to servers.... Data centers with servers processing high value transactions are pretty heavily secured against unauthorized access. (I toured a data center out in Vegas recently and the place was full of armed guards with high powered rifles, as well as plenty of locked doors that only opened with the proper access cards, and surveillance equipment in place.) Even your average small business has a server room with at least a separate lock on the door to the room it's in.
An Amazon Echo compromise is of a bit more interest, because an Echo is likely to just be sitting on a shelf someplace, in plain view. People you invite over during a party or a housekeeper or service person you let inside would theoretically be able to apply this hack without you having a clue it was done.
Doesn't the GPL require letting you be able to make software changes to the item you physically own? (or is that 3.0, I'm too confounded to keep pace with rules.)
You mean from an overt listening device? You could do that just by throwing a towel over it.
You were all warned.
The people who buy them are shitheads. Everything that goes wrong for a person like that is already well-deserved. Frankly, if hackers find a way to turn these things into a lethal weapon that takes out the owner, it will be a net benefit humanity.
This is why I never leave my Echo unattended....especially at a DefCon conference.
It is usually considered that if you have access to a device, you can take control of it.
If we call that a hack that must be fixed, then I fear the solution is more closed software, and repair-hostile hardware.
I really appreciate that my Echo is always listening to me.
It's about the only thing in this house that does listen to me.
It even pays attention and follows orders.
If Echo had been available when I was younger, I would have married one.
Why worry about things like government attacks on end-to-end encryption, when everybody and his dog is signing up for 'personal assistants', installing Smart TV's and IOT devices, and posting their whole lives on social media? The vast majority of people seem to be in the process of making wholesale violations of their own privacy trivial and commonplace - it seems unlikely that they'll give more than five seconds' thought to some security vulnerability in the latest bit of shiny. Damn the bread and circuses, damn the corporatocracy, and damn the public education system that is its longest-lived and most effective tool. Those of us who know better have no hope against the sheer numbers of the Kool-Aid drinking hypnotized masses.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
needing physical access is for amateurs.
signed,
'the feds'
sheesh, i would never think for a second that a device that listened all the time to what was going on around it could be turned into a listening device! Almost like it was designed with that in mind...
They did that for the Blü phones due to the same reason.
Jeez, back in the day these threads would be full of all the projects people were going to do with commercial hardware once somebody found a way to load new firmware onto it.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Give me 5 minutes with a desk lamp back in the 1980s and I'll have turned it into a covert listening device as well.
The people freaking out about this should look into what the FBI and CIA actually did before the internet (hint: still listened into people).
How do you hide the Echo listening device by hacking it?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
N/A
Don't have this physical vulnerability, it's now a built in function. You just gotta figure out how to access it.
watch me turn water into water!!!
Star Trek had it right. First you poke the button on the communicator, then it listens...
Unless you're on the bridge, or in engineering, or ...
"Computer, " and the computer AI responds. Sounds like always listening to me, and ubiquitous surveillance aboard the Enterprise whether or not you have to jab your chest magnet in order to make a call.
The NSA has been able to do that with cell phones for quite some time. AND, they don't need physical access to the device to do it.
So, shove that in your tinfoil pipe and smoke it.
This is NOT new news. So, this old news attention on SlashDot must have another agenda.
Self-importance and self-indulgence is the root of ALL evil.