Louise Matsakis, Motherboard:
The Amazon Echo can be turned into a spying tool by exploiting a physical security vulnerability, according to Mark Barnes, a researcher at cybersecurity firm MWR InfoSecurity. His research shows how it’s possible to hack the 2015 and 2016 models of the smart speaker to listen in on users without any indication that they’ve been compromised.
The issue is unfixable via a software update, meaning millions of Echos sold in 2015 and 2016 will likely have this vulnerability through the end of their use.
Barnes executed the attack by removing the bottom of the smart speaker and exposing 18 “debug” pads, which he used to boot directly into the firmware with an external SD card. Once the hack is complete, the rubber base can be reattached, leaving behind no evidence of tampering.
With the malware installed, Barnes could remotely monitor the Echo’s “always listening” microphone, which is constantly paying attention for a “wake word.” (The most popular of these is “Alexa.”) Barnes took advantage of the same audio file that the device creates to wait for those keywords.
The way I read it, this does require physical access, but once the hack is installed, there’s no obvious way to detect its presence, and an update won’t get rid of the malware.
Feh.
“there’s no obvious way to detect its presence …”
So how do you know that it’s not there from the beginning?
So much for buying any used Echoes off eBay.
Hacked in transit. The preferred method.
This strikes me as much ado about nothing. Given physical access you could do the same thing to say, my toaster.
Granted, that would involve installing an internet connected listening device into the toaster, while the Echo already is an internet connected listening device. This hack might be slightly easier, but only slightly.
Will news like this stop the mad rush by early adopters to fill their houses with as many insecure internet-connected listening devices as possible? Seems unlikely.
There are very real security issues but this really isn’t one of them. The hack needs physical access, someone with the exploit on the SD card… I mean, yeah, someone could break in and plant this when you’re at work but then they could break in and plant bugs anyway at that rate. And no one is going to do that to Joe or Jane random person.
Or you can just connect a cell network bug. This reminds me of the new of the NSA Samsung TV hack that came out a year or so ago. It also required physical access to the TV. That ignores the fact that if the NSA has physical access to your TV, they don’t need it if they want to bug you.
Granted, this sort of hack is useful against a state actor, who is more likely to do bug sweeps, but for a regular person, it’s NBD.
No, I disagree. There’s no extra hardware and no way to reset the software. This is a big problem.
Not huge, mind you, but big.
Yes, it requires physical access. But one time physical access, not continuous.
People who bought this also bought:
— virus x Add to Cart
— malware y Add to Cart
— tracker z Add to Cart
easy solution would be to epoxy up the pads to prevent SD card access.
The difficulty I see is that even if you buy it “new,” you can’t be sure someone hasn’t hacked it already.
Yes. Except Add to Cart is auto-clicked. 🙂
At Amazon? I’d not worry about that. I mean, sure, some warehouse worker could do this (but they’d have to open the boxes) or someone could do this at the manufacturing partner. But that feels like a very low risk and Amazon could simply spot check to eliminate it.
“USED Amazon Echo, Government Surplus! Cheap!”
Other than extra hardware, the same can be said of my toaster hypothetical and the bug examples others mentioned. The extra hardware is easy. It’s the physical access that’s harder to come by.
Other than the extra hardware is a huge thing to put aside, though. “Apart from that, Mrs. Lincoln, how did you enjoy the play?” 🙂
Good thing I’ll never stay at a Wynn Hotel.
<
blockquote>our best friend’s sister gets $60 per hour on the internet and she’s been unemployed for 7 months and the previous month her pay-check was $14051 just working on the internet for a few hours every week.. ➤look ➤at➤ this ➤site
➜➜➜http://www.GoogleFinancialCashJobs11SmartLine/Home/Wage….
✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶✶::::jt11..
Or the post between you and Amazon.
It’s not a big worry, but it’s not zero either.
Eh. I agree it’s not zero but it’s so close to zero that I think it tiptoes next to unreasonable paranoia-land. I mean, at that point you could argue that people could open and hack your TV (see Samsung exploit that required physical access) or, hell, that they could do it to anything, including your iPhone.
No one is going to do this on a mass scale because so much of the take will be trivial day to day things and if you’re the target of someone then we’re back to the above – they can just plant bugs in your house, etc.
I think to someone who wants to listen into you conversations, the extra hardware matters squat.
“Okay, we’ve infiltrated the target’s property. Time to tap his conversations. What?!? He’s got a Google Home, not an Amazon Echo? Oh well, I guess our plan has been foiled. Pack it up, gang. We’re headed home.”
Much ado about nothing.