Amazon Wants to Put a Camera and Microphone in Your Bedroom

mirimir · May 4, 2018

Maybe, I guess. But I'm just not the trusting sort. To be safe, it's gotta be off, and in a Faraday cage

RockLobster · May 4, 2018

mirimir said: ↑

Maybe, I guess. But I'm just not the trusting sort. To be safe, it's gotta be off, and in a Faraday cage
Click to expand...

Do you have an electric guitar?
Interesting thing I discovered. Hold the phone close to the pickup's and turn up the amp, they pick up clearly the data transmission from the phone.
I wonder if I record that as an audio signal would it be possible to inspect the data...
Anyway a brief test seems to suggest airplane mode does work, there was no more data transmission but I'll test that some more.
After I play hell's bells very loudly hehe.

mirimir · May 4, 2018

Nope, no guitar here. That's an interesting RF detector you have there

I do have an SDR. But I don't have a Faraday room. And there's so bloody much background RF where I am.

guest · May 16, 2018

'Voice Squatting' Hack Can Turn Amazon Alexa Into A Silent Spy
May 16, 2018
https://www.forbes.com/sites/thomas...-home-voice-squatting-attack-exposes-devices/

There's a new and novel way to snoop on Google Home and Amazon Echo devices, researchers have told Forbes. It's called "voice squatting" and was uncovered by a group of researchers from Indiana University, Bloomington, the University of Virginia and the Chinese Academy of Sciences.

The hack abuses what're known as "skill markets." Those markets open up third-party services, from banking to cat fact apps, that can be called with certain commands. The researchers found it's possible to create "malicious skills" - those that when invoked by a user's voice command will do sneaky things, like continue to record audio when it's supposed to have stopped. But how to get users to invoke those evil services? Simple: make them sound like a legitimate application and hope Amazon or Google call for the harmful version rather than the innocuous one. Hence the term "squatting."

To add secret recording functionality, the academics used the "reprompt" function. That feature allows a skill to keep running when it doesn't receive a response, as long a notice is issued to users via an audio or text file. The researchers abused this by creating a long, silent audio file as a reprompt so the user wouldn't receive any noticeable warning the mic was still recording.
Click to expand...

guest · May 24, 2018

Woman says her Amazon device recorded private conversation, sent it out to random contact
May 24, 2018
https://www.kiro7.com/news/local/wo...ation-sent-it-out-to-random-contact/755507974

A Portland family contacted Amazon to investigate after they say a private conversation in their home was recorded by Amazon's Alexa -- the voice-controlled smart speaker -- and that the recorded audio was sent to the phone of a random person in Seattle, who was in the family’s contact list.

"My husband and I would joke and say I'd bet these devices are listening to what we're saying," said Danielle, who did not want us to use her last name.
But Danielle said two weeks ago their love for Alexa changed with an alarming phone call. "The person on the other line said, 'unplug your Alexa devices right now,'" she said. "'You're being hacked.'"

"They said 'our engineers went through your logs, and they saw exactly what you told us, they saw exactly what you said happened, and we're sorry.' He apologized like 15 times in a matter of 30 minutes and he said we really appreciate you bringing this to our attention, this is something we need to fix!"
"He told us that the device just guessed what we were saying," she said. Danielle said the device did not audibly advise her it was preparing to send the recording, something it’s programmed to do.
Click to expand...

mirimir · May 24, 2018

At first, I didn't get that Alexa actually includes the capability to record voice, and send recordings to contacts. That blows my mind. Still, I suppose that some would love that. But, as this so clearly demonstrates, it's prone to fail spectacularly.

You'd think that there'd be a confirmation step, such as "Do you really want to send this recording to 'my mother'?" Or "... to 'the police'?"

guest · May 24, 2018

More information about why it has happened (at the end of the article): https://www.wilderssecurity.com/thr...e-secretly-shared-users-private-audio.404131/
... There was a confirmation step and Alexa has asked loud but it has interpreted the background conversation as "right"

mirimir · May 24, 2018

Oh. Missed that. That's pretty funny. I guess that they need a more reliable confirmation step.

RockLobster · May 25, 2018

It's all surveillance technology wrapped up in a consumer friendly package.

guest · Aug 13, 2018

Hackers Found a (Not-So-Easy) Way to Make the Amazon Echo a Spy Bug
August 12, 2018
https://www.wired.com/story/hackers-turn-amazon-echo-into-spy-bug/

[...] that threat has remained largely hypothetical: No Echo malware has appeared in the wild, and even proof-of-concept attacks on the devices have remained impractical at best.

Now, one group of Chinese hackers has spent months developing a new technique for hijacking Amazon's voice assistant gadget. [...] it may be the closest thing yet to a practical demonstration of how the devices might be silently hijacked for surveillance.

"After several months of research, we successfully break the Amazon Echo by using multiple vulnerabilities in the Amazon Echo system, and [achieve] remote eavesdropping,"
[...] requirement that the victim and attacker be on the same Wi-Fi network represents a serious limitation to the attack.

A truly remote Echo hack wouldn't be easy, says Jake Williams, a former member of the NSA's elite hacking team Tailored Access Operations. [...] But if spies could compromise a smart speaker like the Echo, it would make a powerful surveillance device, Williams notes.
Click to expand...

guest · Sep 1, 2018

Researchers show Alexa “skill squatting” could hijack voice commands
Homophones and mistakes in voice processing could be used to phish Echo users, research finds.
August 31, 2018
https://arstechnica.com/information...-skill-squatting-could-hijack-voice-commands/

Called "skill squatting," the attack method (described in a paper presented at USENIX Security Symposium in Baltimore this month) is currently limited to the Amazon Alexa platform—but it reveals a weakness that other voice platforms will have to resolve as they widen support for third-party applications.
Its master’s voice
There have been a number of recent demonstrations of attacks that leverage voice interfaces. [...] And voice-recognition-enabled IoT devices have been demonstrated to be vulnerable to commands from radio or television ads, YouTube videos, and small children.

But skill-squatting attacks could pose a more immediate risk—[...] Thanks to the way Alexa handles requests for new "skills"—the cloud applications that register with Amazon—it's possible to create malicious skills that are named with homophones for existing legitimate applications.

The UIUC researchers demonstrated (in a sandboxed environment) how a skill called "Am Express" could be used to hijack initial requests for American Express' Amex skill—and steal users' credentials.
Click to expand...

guest · Nov 10, 2018

mirimir said: ↑

Except that we know that they're spying. Last year, Amazon released Echo data to investigators in Arkansas, regarding a murder case.

https://www.pbs.org/newshour/nation...murder-case-dropping-first-amendment-argument
Click to expand...

Amazon must give up Echo recordings in double murder case, judge rules
New Hampshire judge orders data handover in 2017 stabbing case
November 10, 2018
https://arstechnica.com/tech-policy...recordings-in-double-murder-case-judge-rules/

On Friday, a local judge in New Hampshire ordered Amazon to hand over Echo recordings made the day a Farmington couple was murdered at their home.

According to local media accounts, Strafford County Superior Court Presiding Justice Steven M. Houran compelled Amazon to disclose not only the audio files but any associated data—such as what phones were paired to the smart speaker—that may be connected to the January 2017 murder of Christine Sullivan and Jenna Pellegrini.

"[...] prosecutors believe there is probable cause to believe there is evidence on the Echo, such as audio recordings of the attack and events that followed it," CBS Boston reported, citing court documents.
Police seized the Echo into evidence during an initial search of the murder scene.

[...] a spokesperson told the Associated Press that it would not give up any data "without a valid and binding legal demand properly served on us."
Click to expand...

guest · Oct 20, 2019

mood said:

#10: Researchers Turn Amazon Echo Into an Eavesdropping Device
April 25, 2018
#29: 'Voice Squatting' Hack Can Turn Amazon Alexa Into A Silent Spy
May 16, 2018
#36: Researchers show Alexa “skill squatting” could hijack voice commands
August 31, 2018
Click to expand...

Alexa and Google Home devices leveraged to phish and eavesdrop on users, again
Amazon, Google fail to address security loopholes in Alexa and Home devices more than a year after first reports
October 20, 2019
https://www.zdnet.com/article/alexa...eraged-to-phish-and-eavesdrop-on-users-again/

Hackers can abuse Amazon Alexa and Google Home smart assistants to eavesdrop on user conversations without users' knowledge, or trick users into handing over sensitive information.

Both Amazon and Google have deployed countermeasures every time, yet newer ways to exploit smart assistants have continued to surface.
The latest ones were disclosed today, after being identified earlier this year by Luise Frerichs and Fabian Bräunlein, two security researchers at Security Research Labs (SRLabs), who shared their findings with ZDNet last week.

The SRLabs team discovered that by adding the "�. " (U+D801, dot, space) character sequence to various locations inside the backend of a normal Alexa/Google Home app, they could induce long periods of silence during which the assistant remains active.
Click to expand...

PHISHING PERSONAL DATA
For example, in the videos below, a horoscope app triggers an error, but then remains active, and eventually asks the user for their Amazon/Google password while faking an update message from Amazon/Google itself.
EAVESDROPPING ON UNSUSPECTING USERS
The "�. " can also be used in a similar fashion for eavesdropping attacks. However, this time, the character sequence is used after the malicious app has responded to a user's command.
The character sequence is used to keep the device active and record a user's conversation, which is recorded in logs, and sent to an attacker's server for processing.

"Finding and banning unexpected behavior such as long pauses should be relatively straight-forward," the SRLabs team told ZDNet. "We are surprised that this hasn't happened since reporting the vulnerabilities several months ago."
Click to expand...

Security Research Labs: Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping

Smart speakers from Amazon and Google offer simple access to information through voice commands. The capability of the speakers can be extended by third-party developers through small apps. These smart speaker voice apps are called Skills for Alexa and Actions on Google Home. The apps currently create privacy issues: They can be abused to listen in on users or vish (voice-phish) their passwords.
Click to expand...

guest · Nov 3, 2019

mood said: ↑

Amazon must give up Echo recordings in double murder case, judge rules
New Hampshire judge orders data handover in 2017 stabbing case
November 10, 2018
https://arstechnica.com/tech-policy...recordings-in-double-murder-case-judge-rules/
Click to expand...

Florida police obtain Alexa recordings in murder investigation
This time, though, officers are more realistic about what they may find
November 3, 2019
https://www.engadget.com/2019/11/02/florida-police-obtain-alexa-recordings-in-murder-case/

Police have once again obtained Alexa voice recordings as part of an investigation, although they're not necessarily expecting a treasure trove of information this time around.

Law enforcement in Hallandale Beach, Florida has used a search warrant to collect Alexa recordings from two Echo Dots as part of a murder case. Investigators want to know if the smart speakers inadvertently picked up audio of a July altercation between Adam Crespo and his wife Silvia Crespo.
As in the past, Amazon stressed in a statement to CBS that it doesn't hand over customer information unless mandated by a "legally valid and binding order," and that it resists "overbroad or otherwise inappropriate" requests.
Click to expand...

Amazon device may have heard slaying, cops say

Amazon’s Echo and Echo Dot, like other smart devices, are constantly listening for a “wake word” that signals when its user wants something — to hear a song, have a question answered, or order a product. But police think the device, nicknamed “Alexa” after its wake word, might have heard and recorded more than a shopping order.

“It is believed that evidence of crimes, audio recordings capturing the attack on victim Silvia Crespo that occurred in the main bedroom ... may be found on the server maintained by or for Amazon,” police wrote in their probable cause statement seeking the warrant.
Amazon spokesman Leigh Nakanishi said the Echo devices only record short bursts of statements and are not eavesdropping on private conversations. “By default, Echo devices are designed to detect only your chosen wake word," he said.
Click to expand...

guest · Dec 18, 2019

mood said: ↑

Alexa and Google Home devices leveraged to phish and eavesdrop on users, again
Amazon, Google fail to address security loopholes in Alexa and Home devices more than a year after first reports
October 20, 2019
https://www.zdnet.com/article/alexa...eraged-to-phish-and-eavesdrop-on-users-again/

Security Research Labs: Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping
Click to expand...

Alexa, Google Home Eavesdropping Hack Not Yet Fixed
December 17, 2019
https://threatpost.com/alexa-google-home-eavesdropping-hack-not-yet-fixed/151164/

Months after researchers disclosed a new way to exploit Alexa and Google Home smart speakers to spy on users, those same researchers now warn that Amazon and Google have yet to create effective ways to prevent the eavesdropping hack.

The researchers who in October disclosed the “Smart Spies” hack, which enables eavesdropping, voice-phishing, or using people’s voice cues to determine passwords, told Threatpost this week that little has been done to prevent the hacks from being launched.

“Nothing has changed,” Karsten Nohl, managing director at Security Research Labs (SRLabs), told Threatpost. “And that in itself is shocking, given how many users are exposed to possible threats right now. It’s been more than five months since our disclosure and the issues persist.”
Vendor Response
Amazon, for its part, did make a few modifications to make the hacks more difficult – however, Nohl said that the mitigations are “comically ineffective.”

“Customer trust is important to us,” an Amazon spokesperson told Threatpost. “We have mitigations in place to detect this type of skill behavior and reject or take them down when identified. [...]"
Google did not respond to a request for comment from Threatpost.
Click to expand...

Security Research Labs: Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping

UPDATE December 17, 2019: Attacks still possible
Six weeks after first publicly discussing the Smart Spies attacks, we performed some retests to see whether Google and Amazon implemented sufficient checks to mitigate the attacks. The below video, filmed on December 5th, shows that all malicious Skills/Actions we submitted were still approved:
Click to expand...

Log in or Sign up

Amazon Wants to Put a Camera and Microphone in Your Bedroom

mirimir Registered Member

RockLobster Registered Member

mirimir Registered Member

guest Guest

guest Guest

mirimir Registered Member

guest Guest

mirimir Registered Member

RockLobster Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Amazon Wants to Put a Camera and Microphone in Your Bedroom

mirimir Registered Member

RockLobster Registered Member

mirimir Registered Member

guest Guest

guest Guest

mirimir Registered Member

guest Guest

mirimir Registered Member

RockLobster Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches