Slashdot Mirror
Hackers Can Turn Amazon Echo Into a Covert Listening Device (helpnetsecurity.com)
Orome1 shares a report from Help Net Security: New research released by MWR InfoSecurity reveals how attackers can compromise the Amazon Echo and turn it into a covert listening device, without affecting its overall functionality. Found to be susceptible to a physical attack, which allows an attacker to gain a root shell on the Linux Operating Systems and install malware, the Amazon Echo would enable hackers to covertly monitor and listen in on users and steal private data without their permission or knowledge. By removing the rubber base at the bottom of the Amazon Echo, the research team could access the 18 debug pads and directly boot into the firmware of the device, via an external SD card, and install persistent malware without leaving any physical evidence of tampering. This gained them remote root shell access and enabled them to access the "always listening" microphones. Following a full examination of the process running on the device and the associated scripts, MWR's researchers investigated how the audio media was being passed and buffered between the processes and the tools used to do so. Then they developed scripts that leveraged tools embedded on the device to stream the microphone audio to a remote server without affecting the functionality of the device itself. The raw data was then sampled via a remote device, where a decision could then be made as to play it out of the speakers on the remote device or save the audio as a WAV file. The vulnerability has been confirmed to affect the 2015 and 2016 editions of the device. The 2017 edition of the Amazon Echo is not vulnerable to this physical attack. The smaller Amazon Dot model also does not carry the vulnerability. More technical details can be found here.
This is like saying that hackers can turn a car into a transportation device.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
How many average consumer devices can't be compromised with physical access to the hardware?
Couldn't someone also just plant a bug in the thing (or somewhere else in your house) and listen to you that way?
In what world is this news?
Always listening device,
Who in their right mind thought these tools would be useful to a consumer? Are people out there really that dense to think that a device like this isn't sending every waking minute of their lives to some spook at the NSA?
Every time I hear someone go on and on about how the "Internet of Things" is the next great land rush, I laugh. The sooner this and 360 VR die the better.
If hackers turn all mobile phones into global echolocation surveillance system, that is going to be way more interesting. Do you ever ask yourself how google gets information about traffic jams? Every mobile phone is being tracked. What is the point to hack Amazon Echo when we have mobile phone in every pocket?
Star Trek had it right. First you poke the button on the communicator, then it listens...
No Shit Sherlock.
Back in '90 or I was sysadmin when we got a bunch of personal Sun workstations. These all had microphones on them, Usenet soon told me how to turn the mic on and record to a local file. Went to my boss, told him we needed to open up every box and cut a wire. He was all like "um, no, not gonna happen". Told him to wait 5 minutes, then call someone and talk for a minute or two. Went into his office, played back the audio file I'd recorded of his conversation, spent the next few hours opening up brand spanking new Sun workstations to cut a wire.
Why yes, I do have black tape over the camera on my laptop. Why do you ask?
You mean from an overt listening device? You could do that just by throwing a towel over it.
It could be compromised before the box even arrives at your house. For that matter it could even be compromised before it leaves the factory.
>"It could be compromised before the box even arrives at your house. For that matter it could even be compromised before it leaves the factory."
It might even be DESIGNED compromised with built-in back doors for three letter agencies or whatever.