Is Alexa spying on YOU? Security researchers reveal how the assistant’s code could be tweaked to create new ‘skill’ that lets it eavesdrop
- Security researchers adjusted code for an Alexa ‘skill,’ which enabled the Echo device to continue recording long after users have made a command
- It allowed developers to gain access to transcriptions of private conversations
- Amazon says it has made it impossible to replicate the eavesdropping tactic
Security researchers have discovered a troubling flaw that confirms what may be many people’s biggest fear about smart home devices.
By creating a ‘skill’ for Alexa, the popular voice assistant created by Amazon, the researchers were able to make the smart speaker listen in on and record any conversations that it hears while eavesdropping.
Not to worry, though, as Amazon says it has fixed the issue.
Scroll down for video
Cybersecurity firm Checkmarx created what seemed to be a harmless calculator skill, or an application used for Echo devices, that would record long after a user made a command. File photo
Researchers at cybersecurity firm Checkmarx created what seemed to be a harmless calculator skill, or an application used for the voice-activated assistant, that would secretly record long after a user made a command.
Alexa-enabled devices are programmed to only respond and record interactions when they’re prompted by a ‘wake word’, such as ‘Echo,’ ‘Alexa’ or ‘computer’.
After a user gives a command, Alexa is supposed to end the session or listen for another command, which means that the session remains briefly open.
The researchers tried to exploit this vulnerability by altering Alexa’s coding.
Developers wrote in code called ‘shouldEndsession’ that enabled Alexa to continue listening even if it understood a user’s command.
Normally, Alexa will say something like, ‘I’m sorry, I didn’t get that’ if she doesn’t understand a command.
Developers wrote in code that enabled Alexa to continue listening even if it understood a user’s command, without providing any prompt that it was still eavesdropping
Alexa-enabled devices are programmed to only respond and record interactions when they’re prompted by a ‘wake word’, such as ‘Echo,’ ‘Alexa’ or ‘computer’. Developers discovered how to adjust the code so that the devices would continue eavesdropping without the user knowing
But the researchers figured out that they could just enter empty values instead of words, so that Alexa didn’t provide any prompt that she’s still eavesdropping.
It allowed Alexa to continue listening in and recording long after the user thought they’d completed the session.
Not only did the skill continue to listen, but coding also instructed Alexa to transcribe the conversation, making it searchable by developers.
‘We didn’t get any audio indication that we are still being recorded, but everything uploaded to Amazon and was sent to the hacker,’ a researcher said in a video demonstrating the vulnerability.
The attack only provides transcriptions, not recordings, of your conversations to hackers.
But it’s still a frighteningly easy vulnerability that could be exploited by savvy developers.
All it takes is an unsuspecting user to download a Skill, much like they could download a malicious app on a smartphone.
The Checkmarx team said it didn’t make the calculator skill available to the public, however.
Checkmarx tipped Amazon off to the vulnerability earlier this month and the firm says it has since fixed the issue.
Amazon made it impossible to replicate the eavesdropping tactic by getting rid of the ability to silence reprompts and shortening the amount of time that Alexa is able to listen for
DOES GOOGLE RECORD CONVERSATIONS WITHOUT A USER’S KNOWLEDGE?
MailOnline has received a number of transcripts of conversations that show the records Google keeps of searches made using the Voice Assistant.
A number appear to have been made accidentally, without the knowledge of the user.
One example from an anonymous tipster appears to have registered the code to their back door entry system, while chatting with a friend.
A written transcript of the conversation said: ‘If you ever get booked down to my house for some reason the key safe for the back door is 0783.’
Another user’s conversation about technology appears to have been captured, without them realising the assistant was recording.
They said: ‘Mate. We’re living in the future. I’ve just installed a game through the Steam app remotely on my PC in London from my phone.’
Another clip from the same person appears to have captured them saying ‘F*** off’ to someone.
Others show more routine search requests, including recipes for a feta and tomato omelette and information on ‘who invented the flush toilet.’
Another shows some of the problems users may experience being understood by Voice Assistant, as demonstrated by a repeated Halloween inquiry on how to carve a pumpkin, with the word ‘carving’ confused for ‘stop coughing’.
Amit Ashbel, director of product marketing for Checkmarx, told CNET that Amazon made it impossible to replicate the eavesdropping tactic by getting rid of the ability to silence reprompts and shortening the amount of time that Alexa is able to listen for.
‘Customer trust is important to us and we take security and privacy seriously,’ the firm told CNET.
‘We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do’.
The researchers’ findings may serve as a scary reminder to some of the dangers presented by voice-activated smart speakers such as Alexa.
Source: Read Full Article