The same cyber team that cracked open TikTok, WhatsApp, Microsoft’s cloud and even Philips lightbulbs has just turned its attention to Amazon’s Alexa. And, unsurprisingly, it hasn’t disappointed. After “speculating” that Amazon’s 200 million devices “could be a prime entry-point for hackers,” Check Point Research has just lifted the lid to unmask “serious security flaws in Alexa.” According to the team, “in just one click, a user could have given up their voice history, home address and control of their Amazon account.”
Warnings about the dangers of smart speakers and their extended families of virtual assistants are not new. These are the same devices that causes such scandal last year, when it transpired humans were listening to conversations to better train the AI. The issue here is different, much more akin to the broader problem of IoT security. Every different gadget you connect to the internet becomes a potential vulnerability. Check Point tells me the methods needed to crack Amazon’s devices were not particularly sophisticated.
First things first—Amazon was obviously informed about the risks and quickly patched its software. A spokesperson for the company told me “the security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us. We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed.”
So, all fine now, but how did this particular threat work? As with most such attacks, it started with a crafted link, sent to a victim by email or text. This link triggered a vulnerability within AWS, allowing the attacker to “silently install skills on a user’s Alexa account, get a list of all installed skills on the account, silently remove an installed skill, get the victim’s voice history or personal information.”
Put more simply, the user clicks a messages link which directs them to an Amazon site where the attacker has set a trap to inject malicious code. The attacker pulls a list of the user’s installed Alexa apps and their security token, deletes one of the apps and installs one of their own with the same trigger phrase. As soon as that the user tells Alexa to run that app, the hacker is in business.
Such an attack could be sporadic—sent to random users to see how many would bite, or it could be targeted at a specific individual. In the latter case, Check Point’s Oded Vanunu told me, “an attacker could carry out a more elaborate attack by getting the list of skills and replacing one of their skills with a similar looking malicious skill.” And while the exploit is not especially sophisticated technically, “a combination of XSS, CSRF and CORS misconfigurations,” for a user this attack would appear “seamless and sophisticated.”
As ever with these kinds of disclosures, the technical specifics are irrelevant to most users. The vulnerabilities have been patched—users just need to make sure their devices are always updated, which should happen automatically. The really important message is to understand how to stay safe from the risk of such attacks, ensuring that you don’t leave yourself and your homes wide open.
“We are issuing some safety tips and guidelines on Alexa use,” Check Point spokesperson Ekram Ahmed told me. “Avoid unfamiliar apps—don’t install these on your smart speaker. Be careful what sensitive information you share with your smart speaker, such as passwords and bank accounts. And read up on any apps—nowadays anyone can create smart assistant apps, so read about the app before you install it and check what permissions it requires. Anyone can publish a skill, and skills can perform actions and get information.”
A virtual assistant becomes more useful the more applications it has and data it has access to—this is the issue. “Any user’s personal information that was shared with the Alexa device could be potentially at risk,” Vanunu explained. “These apps could be finance or retail apps. With this attack, I could uninstall and install fake apps that will be triggered by calling to the safe uninstalled application.”
I asked Vanunu if such an attack could bridge to the surveillance tech in a home. Yes, he told me. “The attacker can potentially access unsecured cameras if the camera’s developer created an Alexa skill with mismanaged authentication. In this scenario, the attacker could uninstall the camera skill and replace it with a malicious skill that sends all the footage to the attacker.”
As ever, the more of this technology we install and deploy, the greater the risks we run. These issues have been patched, but it’s worth taking this as a timely warning that overloading smart speakers with the same plethora of apps which now clog up our smartphones is not a good idea. The same warnings apply. Do not install apps you can’t verify or from sources you don’t fully trust. These devices are placed in our homes and can listen to everything we say, monitoring everything we do. It’s worth thinking that through.
The post Why You Must Beware What You Ask Amazon Alexa appeared first on Trax News.
