Amazons Alexa Could be Tricked into Spying on Users

Amazon's Alexa Could be Tricked into Spying on Users

Researchers at Checkmarx were able to build an Alexa skill which could be used to spy on users within earshot. Amazon has now closed the loophole.

Security researchers say they have found a way to make Amazon's Alexa listen in on its users indefinitely, and provide a transcript of everything said in front of the device.

Researchers at cybersecurity firm Checkmarx were able to create an Alexa skill - an applications for the voice-activated assistant - that was able to eavesdrop on users. They created what appeared to be a simple calculator skill for solving math problems but it was actually designed to send transcripts of anything said within earshot of the device back to its creators.

The Alexa service is designed to be fully awake and listening when the user requests the device to list. The active cycle is supposed to be relatively short, with Alexa informing the user when an open session is closed and it is going back to sleep. Researchers decided to examine if the way Alexa listens like this could be exploited.

Once Alexa has performed a task, the code makes a "Should End Session" query, in order to determine if the session remains open or closed after Alexa reads back text, potentially allowing Alexa to stay active for another session. In order to stay active for another session, Alexa sends the user a vocal prompt, informing them that it is still active.

However, researchers found that Alexa's API accepts an empty reprompt code, allowing the vocal prompt to be silent. That means that while Alexa believes it has told the user that the device is still listening, the user is unaware that this is the case.

The blue light on the Echo could give away that the device is still active, but it's possible that users won't notice, or simply won't be looking at the device.

“Echo users need to recognize that 'Alexa Skills' are third-party applications. Just like with any other computing device, users need to be cautious about what applications (or skills) they load and who is providing them. Poorly designed or blatantly malicious applications can lead to degraded user experience as well as privacy or security exposures," security researcher for Tripwire's Vulnerability and Exposure Research Team, Craig Young said. “I would not necessarily call this a security loophole on the part of Amazon. The bottom line here is that for this ‘hack’ to work, a user must load and activate the malicious skill and then ignore the fact that Echo’s blue light remains on.”

Checkmarx disclosed its findings to Amazon, which told the media that it has acted to ensure that skills can no longer be exploited in this way.

"Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do," a spokesperson said.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

  • DHS to End ‘Shoes-Off’ Travel Policy

    Homeland Security Secretary Kristi Noem announced a new policy today which will allow passengers traveling through domestic airports to keep their shoes on while passing through security screening at TSA checkpoints. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.