Meet Malexa, Alexa’s malicious twin: Malware-induced misperception through intelligent voice assistants

"Hey Alexa, What do You Know About the COVID-19 Vaccine?" -- (Mis)perceptions of Mass Immunization Among Voice Assistant Users

“…It is interesting to note that absence of explicit information about the administration of COVID-19 to children made both the conservative-and liberal-leaning participant express a more hesitant position to child vaccination for COVID-19. V. DISCUSSION Consistent with the previous evidence on inducing misperceptions with a third-party malicious Alexa skill [14], we found that the aspects of the COVID-19 vaccine that involve an external entity, the government or the vaccine manufacturers, were the aspects where users could be misled to ignore otherwise valid information. For the aspects where hard evidence about the vaccines hasn't changed during the study -safety, side effects, and reported efficacy -Alexa wasn't able to dispel any biases that were rooted in personal beliefs [38].…”

“…Malware-induced misperceptions are a fairly new concept that targets the integrity of the content communicated online. The authors in [14] found that a malicious third-party skill for Alexa could successfully warp the perceptions regarding government action by rephrasing regulatory bulletins. Replacing formal language with every-day vernacular ("fine" rephrased as "slap on the wrist") and keeping the facts intact, the skill was able to present the government as pro-business when it comes to workplace safety regulations, contrary to its original pro-workers position.…”

“…A third-party skill that implements logic similar to that in [14] could potentially change the perception of the safety, efficacy, distribution, and both short and long-term effects of the COVID-19 vaccine. The current COVID-19 pandemic provides ample opportunities for inducing misperceptions regarding vaccines [16].…”

“…The misperception-inducing logic is enabled by customizing, in a relatively easy way, a blueprint template and registering a seemingly benign skill. As discussed in [14], a thorough certification process could uncover the malicious logic and remove the skill from the Amazon Skills Store. Another solution is monitoring for suspicious skills' behaviour with a tool like the SkillExplorer proposed in [48], although the "maliciousness" of is not related to any privacy or confidentiality evasion.…”

“…Studies in the past had found that users usually trust Alexa and worry only about Alexa intruding into their privacy, but not about the validity of the information delivered by Alexa [13]. Akin to posting unverified claims on mainstream social media, studies have shown that bad actors can develop malicious third-party applications, called "skills" for Alexa that can silently rephrase information from any source to mislead a user and induce misperception about a polarizing topic such as vaccination, free speech, or government actions [14]. This motivated us to explore how users will respond when such a third-party skill is used to deliver alternative narratives about the COVID-19 vaccine.…”