Slashdot Mirror
Researchers Hacked Amazon's Alexa To Spy On Users, Again (threatpost.com)
New submitter lod123 writes: A malicious proof-of-concept Amazon Echo Skill shows how attackers can abuse the Alexa virtual assistant to eavesdrop on consumers with smart devices -- and automatically transcribe every word said. Checkmarx researchers told Threatpost that they created a proof-of-concept Alexa Skill that abuses the virtual assistant's built-in request capabilities. The rogue Skill begins with the initiation of an Alexa voice-command session that fails to terminate (stop listening) after the command is given. Next, any recorded audio is transcribed (if voices are captured) and a text transcript is sent to a hacker. Checkmarx said it brought its proof-of-concept attack to Amazon's attention and that the company fixed a coding flaw that allowed the rogue Skill to capture prolonged audio on April 10.
No hacking possible. It was the only way to have this nifty toy and be safe.
If you invite a burglar in your house and open the door, you should not blame the lock maker.
We can access and turn on all listening (by which we can detect what you type, how you walk, who you are) on all smartphones, all smart TVs, all smart video boxes, pretty much anything with a microphone and/or a camera, no matter how you switch it off.
Even masking will only reduce the vibration, by the way, we can still hear you quite well. It does obscure the camera, however.
And it's uploaded to the cloud without you realizing it. Even when you "turn it off".
About the only way to turn off the microphones is to cut their power.
Yes, that includes a certain elderly person's cellphones. We play his recordings at parties, with a dubstep backbeat. Hilarious.
-- Tigger warning: This post may contain tiggers! --
I wonder if I can say "Alexa, are you up to date on your patches?" It turns out "she" didn't know what I was talking about.
lod123 has been spamming for a month straight for threatpost.
This is like claiming you've hacked a glass to be able to hold water.
Dear Editors,
Please save us some trouble and just start including this in every Alexa/Siri story posted here.
Thanks and regards,
--Z.
Il n'y a pas de Planet B.
This hack isn't very well hidden:
One big issue Checkmarx faced is that on Echo devices a shining blue ring reveals when Alexa listens
I'd be more worried about it if they could listen without the indicator light on.
Since apparently no one can convince most people to not buy these gods-be-damned things in the first place, at least try to convince them to unplug the power from it when they're not actively using it. Make up some plausible reason that will trigger them emotionally, like "so pedophiles won't be listening in on your kids" or something like that.
When work got an Echo to play around with, I came up with exactly this idea - listen to meetings and save them (maybe as audio, but definitely transcribed to text). I was *shocked* to learn that you can't officially do this, because it seems like such an obvious thing for the Echo to do.
Now hackers work out how to do it, only for Amazon to close the exploits and *still* not release this idea as an official Alexa skill. Now that they've added the ability to train and recognise individual voices, a text transcription identifying each speaker as they say something is most definitely possible now. As it stands, our Echo sits around doing nothing because there's basically nothing in a business context it's currently useful for.
Wouldn't it be easier to bug their house?