Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
1–10 of 13 posts
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#2Dick Morrell urgently advising Amazon users to sign out of all devices, reset their passwords, and delete 2FA tokens due to an unspecified security issue. The issue appears to be related to Amazon Echo devices, which have been accused of scanning users' Wi-Fi networks and sending detailed profiles of network equipment back to Amazon. The code for this functionality is allegedly contributed by the US National Security Agency, raising concerns about privacy and unauthorized surveillance. Users are encouraged to take immediate action to protect their accounts and devices, as the full extent of this security problem is still unclear.
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#3Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#4To view this and other Mastodon toots without Javascript add "/embed" to the left side of URL.
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#5Dick Morrell urgently advising Amazon users to sign out of all devices, reset their passwords, and delete 2FA tokens due to an unspecified security issue. The issue appears to be related to Amazon Echo devices, which have been accused of scanning users' Wi-Fi networks and sending detailed profiles of network equipment back to Amazon. The code for this functionality is allegedly contributed by the US National Security…
[deleted]
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#6Dick Morrell urgently advising Amazon users to sign out of all devices, reset their passwords, and delete 2FA tokens due to an unspecified security issue. The issue appears to be related to Amazon Echo devices, which have been accused of scanning users' Wi-Fi networks and sending detailed profiles of network equipment back to Amazon. The code for this functionality is allegedly contributed by the US National Security…
It's unclear if he's also recommending to leave echo devices disconnected, or just cycling the auth info.
Based on what he's sharing now, there are hints of two issues:
1) authentication information including MFA secrets might be leaked and need to be cycled. (this would be surprising)
2) Echo devices perform undisclosed reconnaissance on nearby wifi networks (not particularly surprising)
These seem like totally separate issues with different impacts and different mitigation techniques.
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#7If the vulnerability can't be revealed for "ethical" reasons, that implies it's ongoing... so what would a reset do? Wouldn't the newly reset credentials be just as vulnerable until fixed?
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#8If the vulnerability can't be revealed for "ethical" reasons, that implies it's ongoing... so what would a reset do? Wouldn't the newly reset credentials be just as vulnerable until fixed?
Keep changing it until he says it's OK to stop. /sarcasm
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#9Dick Morrell urgently advising Amazon users to sign out of all devices, reset their passwords, and delete 2FA tokens due to an unspecified security issue. The issue appears to be related to Amazon Echo devices, which have been accused of scanning users' Wi-Fi networks and sending detailed profiles of network equipment back to Amazon. The code for this functionality is allegedly contributed by the US National Security…
This user appears to be generating comments with GPT.
Re: Dick Morrell: Amazon Users Advised to Reset Passwords Amid Echo Privacy Concerns
#10He doesn't say the issue is limited to Echo devices.
Yes, Echos are scanning wifi and phoning home details you didn't authorize, which is a bad thing but not the issue here.
Morrell says the issue is with all retail Amazon accounts (possibly not AWS-only accounts.)