A first look into Alexa's interaction security

Abstract

With a rapidly increasing market of millions of devices, the intelligent virtual assistants (IVA) have become a new vector available to exploit security breaches. In this work we approach the third revision of the Amazon Echo ecosystem's device Alexa from a security perspective, focusing our efforts on the interaction between the user and the device. We found the client-server communications to be robust using encryption, but studying the voice message recognition system we discovered a method to execute voice commands remotely, a feature not available by default. This method could be used against the user if an attacker manages to perform a session hijacking attack on the web or mobile clients.

On the Security and Privacy Challenges of Virtual Assistants

“…Privacy was found to be the biggest concern of the three [ 14 ]. These findings appear to conflict with those presented by Lau et al [ 21 ]; however, the construction of the surveys was different, as privacy was the primary goal of the study. Moreover, Burbach et al [ 11 ] wrote their study a year later; a year in which several news stories broke in the media regarding privacy concerns of VAs, which may account for the apparent increase in concern over privacy.…”

“…Javed et al [ 21 ] performed an in-depth study of what Alexa was recording. AlthoughAmazon claims that ‘she’ only listens when the wake-word is uttered by the user, their research found that among the control group of users, 91% had experienced an unwanted recording.…”

Untitled

“…Another study to highlight security issues of voice assistants was conducted by Castell-Uroz et al [64], who analyzed the servers and services that Amazon Alexa has daily access. From this process, it emerged that when a voice assistant communicates with a service at the user's command and uses the http protocol, it is not difficult for someone to access the data sent to Amazon servers.…”

When Speakers Are All Ears: Characterizing Misactivations of IoT Smart Speakers

“…Recently, a number of commercial IoT security tools and applications have entered the consumer market which enable device identification and network destination analysis, although they do not provide analysis of voice activations in smart speakers [20,21]. In [22], the authors attempted remote voice command execution and session hijacking attacks on the Alexa devices. Their findings highlight some security vulnerabilities in these devices.…”