An Alexa Bug Could Have Exposed Your Voice History To Hackers (wired.com) 42
An anonymous reader quotes a report from Wired: Findings published on Thursday by the security firm Check Point reveal that Alexa's Web services had bugs that a hacker could have exploited to grab a target's entire voice history, meaning their recorded audio interactions with Alexa. Amazon has patched the flaws, but the vulnerability could have also yielded profile information, including home address, as well as all of the "skills," or apps, the user had added for Alexa. An attacker could have even deleted an existing skill and installed a malicious one to grab more data after the initial attack. [...] For an attacker to exploit the vulnerabilities, they would need first to trick targets into clicking a malicious link, a common attack scenario. Underlying flaws in certain Amazon and Alexa subdomains, though, meant that an attacker could have crafted a genuine and normal-looking Amazon link to lure victims into exposed parts of Amazon's infrastructure. By strategically directing users to track.amazon.com -- a vulnerable page not related to Alexa, but used for tracking Amazon packages -- the attacker could have injected code that allowed them to pivot to Alexa infrastructure, sending a special request along with the target's cookies from the package-tracking page to skillsstore.amazon.com/app/secure/your-skills-page.
At this point, the platform would mistake the attacker for the legitimate user, and the hacker could then access the victim's full audio history, list of installed skills, and other account details. The attacker could also uninstall a skill the user had set up and, if the hacker had planted a malicious skill in the Alexa Skills Store, could even install that interloping application on the victim's Alexa account. Both Check Point and Amazon note that all skills in Amazon's store are screened and monitored for potentially harmful behavior, so it's not a foregone conclusion that an attacker could have planted a malicious skill there in the first place. Check Point also suggests that a hacker might be able to access banking data history through the attack, but Amazon disputes this, saying that information is redacted in Alexa's responses. "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson told WIRED in a statement. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."
At this point, the platform would mistake the attacker for the legitimate user, and the hacker could then access the victim's full audio history, list of installed skills, and other account details. The attacker could also uninstall a skill the user had set up and, if the hacker had planted a malicious skill in the Alexa Skills Store, could even install that interloping application on the victim's Alexa account. Both Check Point and Amazon note that all skills in Amazon's store are screened and monitored for potentially harmful behavior, so it's not a foregone conclusion that an attacker could have planted a malicious skill there in the first place. Check Point also suggests that a hacker might be able to access banking data history through the attack, but Amazon disputes this, saying that information is redacted in Alexa's responses. "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson told WIRED in a statement. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."
no alexa (Score:3, Insightful)
No Alexa, no problem.
Re:Oh Yes Alexa, yes Yes YES! (Score:2)
Meanwhile in other news... [nypost.com]
You want security? (Score:2)
Agreed. Every new compromise highlights just how little Amazon cares about your privacy.
I mean seriously - why is Alexa even storing your voice history? Maybe there's some benefit to storing a very brief history to apply statistical analysis to improve service, but what I said six months ago is completely irrelevant to satisfying my current request.You want to keep potentially sensitive information secure on an internet connected device? Delete it. Or better yet, don't store it in the first place. Ther
Shocked, I tell ya (Score:1)
Oh, the horror! (Score:2, Troll)
They'll learn about my bizarre taste in music, see my shopping list, and know what time I get up in the morning! Oh, I just could not live with that!
Re: (Score:2)
Alexa? Find me some hookers, blackjack and coke (Score:2)
Seriously, why allow these "things" into your house.
I understand if you're an Alzheimer support team or so stupid you don't care, but Really?
Re: (Score:2)
It is quite useful as a light switch for a lazy person like me.
Re:Alexa? Find me some hookers, blackjack and coke (Score:4, Informative)
The newer ones have a pretty good speaker (or can interface with really good speakers). 99% of our usage consists of playing music, turning lights and the fishpond pump on and off, and setting alarms. I'm really not clear on what "sensitive information" Amazon would be storing.
Re: (Score:2)
Well if you're using Alexa to set alarms then burglars might figure out when to rob you, and if you can set an alarm with an insecure device then they might also be able to turn your alarm off through hacking.
Re: (Score:2)
You apparently haven't met any thieves, they're thieves because they're lazy and stupid. Any reasonably ambitious and intelligent person will make far more in a year honestly than almost any burglar, and anyone who can hack Amazon isn't going to be boosting your television they'll go for something actually worthwhile. A regular thief will just ring your doorbell pretending to sell magazines or toss a rock through your window and see if anyone responds.
And your home alarm system is useless unless you're pa
Re: (Score:2)
Re: (Score:2)
Physical security. I do this stuff all day every day. I've known half a dozen 911 dispatchers and have worked with 5 police departments.
If your alarm doesn't make enough noise to piss off the neighbors enough for them to call the police then no one is going to be dispatched. This is real life, not TV. If you're actually worried about a B&E then cough up the extra to have the alarm company send a patrol themselves.
Re: (Score:2)
Re: (Score:2)
No, someone builds a tool with automation to hack your Alexa quickly and easily. The dumbass criminals buy this tool and actually use it. You still have a problem if you have internet connected locks and/or streaming video from in/around your home.
Self-respect? (Score:4, Insightful)
Walls have ears (Score:2)
They're completely fine with having random strangers record their lives?
Given how thin apartment walls are, pretty much all their neighbours can hear everything that goes on in another person's life, anyway.
Re: (Score:2)
What makes you think they actually have lives?
On another note - is this not what Alexa is for?
Re: (Score:2)
A couple of points, first off Amazon isn't "recording their lives", it records the sentence after the wake up word, sends that to AWS for analysis, and then carries out the response. If I tell it to play the 'Ultimate Classical' playlist it's not going to record anything else for the next couple of hours unless I tell it to skip a song. That doesn't seem at all intrusive to me.
Second, you're being recorded every time you step out of your house. The police in England alone have access to over two million c
Re: (Score:1)
If you believe that, I have a bridge to sell you.
Go into any store and you're on the Panopticon. Do you consent to any of that?
No, but I'm not being recorded in my bedroom. Huge difference. I don't expect to have privacy on a public street. I do in my home. That's why I have a home.
Re:Self-respect? (Score:5, Interesting)
Which bridge? Does it have a nice view of the river?
I work at Amazon (physical security, nothing to do with programming), the company has no interest in your conversations with the cat. You're not that interesting, and it's makes no financial sense to spend the time, bandwidth, and storage to record anything not associated with usage of their product.
Do you know how to use WireShark? Visit someone who has an Echo device, check the MAC address on the Echo, and watch the traffic. I don't expect you to go out and buy one afterwards, but at least you won't be spouting nonsense.
Hacker (Score:3)
Hacker [häxør]
Someone who pays Amazon for information gathered by Alexa.
Alexa, the finest furry porn, stat! (Score:1)
My god, what have I done?
As opposed to ... Amazon employees. (Score:2)
Not sure which one is worse.
Re: (Score:2)
There's one thing I'd do if I owned one of those awful devices: I'd come close to it, pretend I'm talking with another person on the phone, and say "You know what? I'm really glad we killed Jeff yesterday. That went really well, nobody saw us and we finally got rid of the bastard." without actually addressing the device.
If Amazon is listening in, they have a problem: they're legally obliged to report me to the police under federal Law 18 U.S.C. section 4. But if they do, they officially reveal that they spy
Re: (Score:2)
Umm, how is that a problem? They *already* officially reveal they spy on people - in fact it's in the terms of service.
Re: (Score:2)
I work with people who program these things, and they're not spying on you or recording your conversations. Your life really isn't that interesting.
Want to actually tell if you're being recorded? Set up WireShark and sniff the traffic to/from your router. It's easy to identify the Echo, the MAC address is printed right on it. You'll see an occasional ping to AWS to verify that the connection is still good, and nothing else until you say the wake up word. Then there will be a short flurry of traffic as
Re: (Score:2)
Re: (Score:2)
Useful amounts of data? Bullshit.
Re: (Score:2)
What the hackers have really gathered (Score:3)
From me they're probably going to learn new and interesting ways of swearing, given the number of attempts it takes to make the damn machine play the music you have chosen instead of the one it supposedly understood through voice recognition.
Re: (Score:2)
I happen to enjoy the complete randomness Alexa has with music (primary use case for us, then alarms, then weather).
In many cases I have to use my laptop to find an exact song name, try and get it to play "love is what I got - reprise by Sublime" (the acoustic version, last song on album). It will work, but after a few comical attempts.
Re: (Score:2)
You can look in the history in your Alexa app and see what it understood, then mark it correct or not. This can help a lot when you have a specific command that it has trouble understanding. You can also say, "Alexa, learn my voice." It will run you though a short script that will improve its analysis of future commands.
When I told my wife we could change the wake up word to 'Amazon' or 'Computer' she asked, "Can I tell it 'Hey, bitch'?" No, sorry love, that's not supported.
"Alexa Bug Could Have Exposed Your Voice History" (Score:1)
No, it couldn't have. I don't use Alexa.
Duh! (Score:2)
Obviously you have to tell Alexa each night:
"Alexa, forget everything I ever said!"
Trying to not be smug (Score:1)
but this is exactly the kind of scenario that has led to me not allowing one of these devices in my house.
NOPE.
LK