Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alexa and Google Home expose users to vishing and eavesdropping

srlabs.de

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Alexa and Google Home expose users to vishing and eavesdropping

#21

Post by cactus2093 »

jka wrote: post #13
jMyles wrote: post #6

Earlier quoted context omitted.

The more important question is: how do we know whether these devices (or a particular subset of them) record all the time or only after the trigger word?

... while also considering the possibility of faulty software updates, bugs, and network attackers -- in an environment where hardware, network protocols, and APIs are proprietary and inscrutable. And would we know if they had been recording unnecessarily?

Well they don't have big hard drives, so you can be confident they're not recording everything to disk that then could be unintentionally accessed or sent out later.

And you can look at network traffic (e.g. from wifi router stats) to be pretty confident they're not constantly live-streaming audio up to the cloud.

Of course most people will not actually do this monitoring themselves, but there are enough of these devices out there that if a significant number started recording constantly somebody would notice pretty quickly. And that would be terrible PR for the company involved, so I think google and amazon and apple have a pretty strong incentive not to do this.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#22

Post by kortilla »

skeletonjelly wrote: post #17
jMyles wrote: post #6

Earlier quoted context omitted.

The more important question is: how do we know whether these devices (or a particular subset of them) record all the time or only after the trigger word?

By a) viewing what they store via their log tools (though this isn't guaranteed to show everything, ie if they are recording everything they couldhide) b) monitoring outbound network connections

Neither of those things are indicative. Secretly recorded things could be hidden from logs and bundle up recordings with normal voice queries on the network calls.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#23

Post by nodamage »

jMyles wrote: post #6
kayhi wrote: post #3

Do these devices record all the time or only after the trigger word (they would need to be always listening for the trigger word) until the end of the statement?

The more important question is: how do we know whether these devices (or a particular subset of them) record all the time or only after the trigger word?

Regardless of intent, we know that all three major voice assistant services (Siri, Alexa, Google Assistant) experience false positives and end up accidentally recording conversations when the device thinks the trigger word was spoken, but actually was not.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#24

Post by eth0up »

If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions.

1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching...

2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am...

Edit to append link and quote:

Quote: However, he noted, there is a workaround if a resident happens to reject a police request. If the community member doesn’t want to supply a Ring video that seems vital to a local law enforcement investigation, police can contact Amazon, which will then essentially “subpoena” the video.

Link: https://www.govtech.com/security/Amazons-Ring-Video-Camera-A...

Re: Alexa and Google Home expose users to vishing and eavesdropping

#25

Post by jen_h »

kayhi wrote: post #3

Do these devices record all the time or only after the trigger word (they would need to be always listening for the trigger word) until the end of the statement?

The device has to record all the time in order to "listen" for the wake word.

It's got a small couple-second buffer (enough to store "Amazon" or "Computer" or "Alexa" or "Echo") where it takes what it hears and compares it with its internal model for a match.

If there's no match, the buffer is overwritten with the next bit of noise. Once the device gets a wake word match, it transmits the statement that follows to home base to transcribe and handle.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#26

Post by asr »

zik wrote: post #2

TIL "vishing" is a word. If like me you were wondering what it meant: "Vishing is the telephone equivalent of phishing. It is described as the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft."

This makes no sense. Phishing comes from phreak + fishing, but the "ph" in phreak is already from the word phone (phone + freak) -- so the ph in "phishing" already comes from the word phone! The telephone version of phishing should be... "phishing."

But thanks for the explanation.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#27

Post by cookie_monsta »

jeremyjh wrote: post #15
cookie_monsta wrote: post #10

> Amazon or Google review the security of the voice app before it is published. We change the functionality after this review, which does not prompt a second round review How is this not a massive red flag?

I don't know for sure about Google, but with Alexa skills are simply implemented as a web service. There is no way for Amazon to know that you've deployed new code on your web service. There are a lot of limits to what you can change though, the prompts / intents are specified in a manifest you have to upload. But what the device does for an existing intent, and the responses it sends, can be changed without their kn…

I just can't believe that people actually pay to have these things in their houses. Or maybe, sadly, I can.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#28

Post by jen_h »

cookie_monsta wrote: post #10

> Amazon or Google review the security of the voice app before it is published. We change the functionality after this review, which does not prompt a second round review How is this not a massive red flag?

You could do the same thing with almost any type of app where you run your own web service; it's kind of a black box to the app market's test group...you could change everything but the domain name and security certificate (and most app stores don't pin the cert as they expire and you wouldn't want to recertify at every cert switch).

One thing Amazon or Google could do here for voice apps, though, that Apple and Google (Android) can't for standard phone apps, is audit voice responses for anomalies or user input that matches a suspicous pattern and flag apps that trigger it.

They can do this because every utterance a user sends a voice assistant passes through Amazon or Google systems. If an app has access to user PII, they could add some automation to flag suspicious user responses or anomalous activity that differs from x days previous and pass it up the chain for review.

One thing I do like about Alexa development is that if you, as a developer, are privacy-minded (and don't need nor want user data for anything), you can protect your users by configuring your apps not to collect any of your users' info . As a developer, you don't even get IP addresses as everything goes User > Amazon > Developer > Amazon > User.

You always get session and Amazon-assigned user id, but they're typically pretty anonymous unless the user says "I am Jane Doe" -- which, I guess we should be honest, probably does happen more than it should, and this is what the OP researchers are exploiting.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#29

Post by swebs »

jMyles wrote: post #6
kayhi wrote: post #3

Do these devices record all the time or only after the trigger word (they would need to be always listening for the trigger word) until the end of the statement?

The more important question is: how do we know whether these devices (or a particular subset of them) record all the time or only after the trigger word?

I'd imagine using something like Wireshark to see how much data it transmits at any given time would be a good start.

Re: Alexa and Google Home expose users to vishing and eavesdropping

#30

Post by jen_h »

adrianmonk wrote: post #12

> It is possible to ask for sensitive data such as the user’s password from any voice app. Newsflash: computing device with the capability for user interaction can request information that you might not want to give it. In other words, how is this situation different from any software running on any other type of computing device?

It's not really any different -- changing server behavior after app review is possible for any server-based app. The one thing they exploited that is unique, though, is that when a user talks to a smart device, they generally don't know at any given time if their commands are going to Google/Amazon or are being passed to Google/Amazon and the third-party developer.

As far as many users are concerned, they're talking to Alexa. The third party app is Alexa, too.

And because of the opaque single-dimensional nature of voice interfaces, even a savvy user doesn't know who's really receiving their intent -- there are enough glitches where you think you're sending to the active skill, but you're back in Alexa's lobby again, so the inverse case the researchers are playing with is a good vector.

I think they could solve some of this because Amazon/Google are gatekeepers -- they get user input no matter where it goes -- they could easily automate detecting anomalous user input and flag for review (that would of course miss the first victims, but it's better than nothing).

I think the "Who's listening?" part is a little harder to solve. Maybe by forcing the third party app to always announce itself as itself? But that does add some friction to the "experience" they want to provide...however, a little friction is better if it means protecting your users.

Post reply on HN