All hardware with a microphone (or speaker since it too can be used as a mic) needs a hardware switch to disable ... Which will only land once open hardware Linux mobiles take off in next year or two ... Until then I just assume nothing is private
Please forgive (and remedy?) my ignorance, but are you saying all hardware speakers can be used as microphones?
Alexa and Google Home expose users to vishing and eavesdropping
41–50 of 64 posts
Re: Alexa and Google Home expose users to vishing and eavesdropping
#42All hardware with a microphone (or speaker since it too can be used as a mic) needs a hardware switch to disable ... Which will only land once open hardware Linux mobiles take off in next year or two ... Until then I just assume nothing is private
Please forgive (and remedy?) my ignorance, but are you saying all hardware speakers can be used as microphones?
Yep! If you want to try this, you can plug any speaker with a 3.5 mm output into a mic input and speak into it. It'll probably be faint, but it usually works.
https://security.stackexchange.com/questions/154343/can-a-sp...
Re: Alexa and Google Home expose users to vishing and eavesdropping
#43Earlier quoted context omitted.
The Google Home mini and Google Home Max have physical sliding mic mute toggles. The original Google Home has a physical momentary mic mute switch (click to disable, click to enable). The Amazon Echo also has a similar mic mute switch.
> momentary mic mute switch (click to disable, click to enable). Momentary switches only activate when pushed and as son as their not pushed deäctivate. Was it a momentary switch or a normal one (push to activate, push to deäctivate)?
Momentary, in that the actual mute function is software-controlled. However, on the Amazon device it does trigger a physical power-down of the microphones, which is hardware-tied to the LED, so you can be sure that when the LED says the mics are off they really are off. I'm not sure about the Google one.
Edit: at least the physical slide switch on the Home Mini is a hardware cut-off; I assume the same is true of the Home Max.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#44> It is possible to ask for sensitive data such as the user’s password from any voice app. Newsflash: computing device with the capability for user interaction can request information that you might not want to give it. In other words, how is this situation different from any software running on any other type of computing device?
I'll take a stab at it. What's different here is that an audio-only UI makes it particularly hard for the user to know what program they're interacting with.
Visual UIs generally offer a host of cues to indicate what program is running, and take special efforts to make security-sensitive interactions and dialogs hard to fake. Using these techniques in a voice UI is tricky. There's no good way to tell where the last output came from, or where the next input is going. How can a user be certain that a request for privileged information is coming from a trusted source? In this example, Google clearly tried to create a signature sound (the "Bye earcon") that lets the user know when an app has exited, but an app was able to fake it. The attack leverages the user's trust that was built up by Google.
I think this article provides a useful example that highlights the particular difficulties securing a voice UI system from phishing attacks.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#45Earlier quoted context omitted.
The Google Home mini and Google Home Max have physical sliding mic mute toggles. The original Google Home has a physical momentary mic mute switch (click to disable, click to enable). The Amazon Echo also has a similar mic mute switch.
These switches interact with software or programmable, connected components. They don't physically disconnect the hardware in a way that only the switch itself can reverse.
Citation needed. I don't see why they wouldn't have made the slide switches physically disable the mics, otherwise what would be the point of using a physical slider switch? The whole point of the feature is privacy.
Edit: I hate people making claims with zero evidence, so here's some evidence for you: I just took apart my Google Home Mini. The mics are digital PDM mics, connected to a shared line (in stereo config), that goes to what is almost certainly an AND gate (tiny IC, can't quite find the part number, pinout matches a SN74LV1T00), with the other input connected directly to the mute switch (via some resistors), and the output to the SoC (via a resistor divider, probably because the SoC input is likely 1.8V logic). When the mute switch is engaged, the output of the AND gate, which is normally a TDM train (average half of 3.3V), goes to 0V. This is the output that goes to the SoC. So when the mute switch is engaged, the audio input from the mics is electrically cut off from the SoC.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#46Earlier quoted context omitted.
... while also considering the possibility of faulty software updates, bugs, and network attackers -- in an environment where hardware, network protocols, and APIs are proprietary and inscrutable. And would we know if they had been recording unnecessarily?
Well they don't have big hard drives, so you can be confident they're not recording everything to disk that then could be unintentionally accessed or sent out later. And you can look at network traffic (e.g. from wifi router stats) to be pretty confident they're not constantly live-streaming audio up to the cloud. Of course most people will not actually do this monitoring themselves, but there are enough of these dev…
How much of a hard drive would they need to do speech-to-text and upload that periodically in with other legitimate traffic?
The PR angle isn't that reassuring to me either, they've already absorbed some pretty bad PR hits on these devices and they're still going strong.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#47Earlier quoted context omitted.
Please forgive (and remedy?) my ignorance, but are you saying all hardware speakers can be used as microphones?
Yep! If you want to try this, you can plug any speaker with a 3.5 mm output into a mic input and speak into it. It'll probably be faint, but it usually works. https://security.stackexchange.com/questions/154343/can-a-sp...
Thanks. I'm embarrassed not to have known this.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#48If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions. 1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching... 2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am... Edit to append link and quote: Quote: However, he noted, the…
Subpoena is the wrong word. Amazon gives up your video willingly to law enforcement without your consent or even knowledge.
They can do this because it hasn’t yet been determined unlawful.
We are in a dire need of cyber ethics framework that enshrines user privacy.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#49Earlier quoted context omitted.
Please forgive (and remedy?) my ignorance, but are you saying all hardware speakers can be used as microphones?
Yep! If you want to try this, you can plug any speaker with a 3.5 mm output into a mic input and speak into it. It'll probably be faint, but it usually works. https://security.stackexchange.com/questions/154343/can-a-sp...
Microphone-less headphones are a great way to test this phenomenon. If you have them handy, just plug them into the mic port and talk. IIRC only one earpiece in a stereo set connects with a mono microphone jack.
Re: Alexa and Google Home expose users to vishing and eavesdropping
#50Im not a fan of devices actively listening and sending snippets (if not all the info) back to home base.
My simple solution is to not use these kind of devices.