Are Hackers Using Popular Assistant Devices To Listen To Users?

November 2, 2019

Written by wukovits

The utility of virtual assistants like Amazon’s Alexa and Google Home are undeniable.  They’re just genuinely handy devices to have around.

Unfortunately, they’re also prone to abuse and exploits by hackers and unsavory developers. They can be used to spy on and even steal sensitive information from unsuspecting users.

This is not new in and of itself.  Security researchers around the world have, at various points over the last couple of years, sounded the alarm about weaknesses and exploits.  To the credit of both companies, any time this has happened, both Amazon and Google have responded promptly, plugging gaps and shoring up the security of their devices.

Unfortunately, every few months or so, new exploits are discovered.  The two companies are essentially playing Whack-A-Mole with security flaws, which appear to have no end.

Recently, security experts published two videos, one for Alexa and one for Google Home. Each demonstrated a simple back-end exploit that anyone with a DevKit could employ.  The exploits revolve around inserting a question character (U+D801, dot, space) to various locations in the code. Then they introduce a long pause during which the assistant remains active and listening.

To give you an idea of how this could be exploited, one of the example videos shows a horoscope app triggering an error, but the presence of the special character introduces a long pause during which the app is still active.

During the long pause, the app asks the user for their Amazon/Google password while faking a convincing looking update message from Amazon or Google itself.  Given the long pause, few users associate the poisoned horoscope app with the password request.  It seems like it’s coming from the device itself.

It’s both sneaky and troublesome, and worst of all, even when both companies move to address this issue. By this time next month if history is a guide, there will be others.  We’re not saying not to use them, but when you do, be very mindful.

Used with permission from Article Aggregator

Related Articles

Some Amazon Device Features May Have Security Risks

Have you heard of Amazon Sidewalk? If not, it's definitely something you should be aware of. Depending on your point of view, the new feature, which was enabled by default on a wide range of Amazon devices by default on June 8 of this year (2021) is either...

Email Unsubscribe Scam Can Easily Fool Any User

Scammers are increasingly relying on a tried and true bit of social engineering to fool unsuspecting users into unwittingly signing up to receive a flood of additional spam email. They accomplish this by blasting out an email asking recipients if they wish to...

Update VMWare Software Immediately To Avoid Possible Attack

The US Cybersecurity and Infrastructure Security Agency recently issued a warning to all companies running VMware Vcenter Server and VMware Cloud Foundation. They are asking them to download and apply the latest security patches as soon as possible because attackers...

Send us a message

Your message was sent.

Thank you for contacting Bayou Technologies. We'll be in touch soon!

Need help? support-icon