Amazon Alexa can be hijacked via commands from own speaker Without a critical update, Amazon Alexa devices could wake themselves up and start executing audio commands issued by a remote attacker, according to infosec researchers at Royal Holloway, University of London. By exploiting a now-patched vulnerability, a malicious person with some access to a smart speaker could broadcast …
wasn't there an unveiling of the first voice activated PC back in the day, the crowd assembled in the auditorium, the PC was set up and shown to the throng, and before anyone could say anything else - FORMAT C - came out of the ether, and before they could assess WTF was happening, someone else shouted - YES - and the whole shebang came to an inglorious halt
I remember those days with a smile, life really was so much simpler then
When I heard that one the voice activation was in a M$ service pack update.
Rest of the office starts complaining as work is lost
"DOS wouldn't format the system drive which it had booted from "
Depends on the version of DOS. In some early versions, simply entering the command FORMAT with no drive letter designated will allow you to format the current drive, regardless of whether your booted from it or not.
If Windows is running off the boot drive, the FORMAT command will not allow you to format that drive, because it is in use.
I've been living with these things since they came out and they're like any other piece of technology, they can be turned off if necessary. In addition to the 'mute' button there's the option of pulling the plug.
Amazon is aware of the possibility that the units could be hacked so should you use the unit for ordering stuff -- something that has to be first enabled in the application -- then you'll have ample opportunities to confirm and cancel the order. Its true that applications could be started but you'd be a complete idiot to connect anything to an interface like this that's potentially hazardous. These devices can record audio, but then anything with a microphone can.
Compared to a lot of Smart Home type toys that you can buy these units are both unobtrusive and seamless. I'm amazed at just how bad most units are -- they require intrusive signups for onine accounts you neither want nor need, they update their software so frequently that you're lucky if the 'app' works from one month to the next and when the provider goes belly up you end up with a paperweight. Bad software is the norm these days, hastily written in a desperate attempt to monetize the unmonetizable. Echo units at least work, they're unobtrusive and they're as useful as they need them to be. They're an object lesson in good product design.
With these things it's not only what they are - but what they're capable of.
First off, do these things process the audio on the device itself? I don't think so.
Can the end user audit every bit of data going out of the thing, choose what goes out, or at least choose what Amazon can and can't do with the data? Fat chance.
Amazon has been caught red-handed overreaching with their IoT crap before.
NYT, on Ring's security incidents
The Guardian, on Ring being used for mass surveillance
Second, technology is (and should be) off until you need it. Smartphones don't abide by that rule - but with a limited battery life, there's only so much that they can do in terms of snooping. Smart speakers and "voice assistants" on the other hand are on by default until muted (at least the mute switch on the Echo speakers is a real switch and not software-controlled) - and with an infinite power supply, there is quite the potential for becoming a "bug".
Third, doesn't muting an Echo defeat its very purpose (at least as advertised) of being the future voice assistant that can be called anytime and anywhere in the house? Therefore what most people will do is that they'll leave the damn thing on because they're too lazy to unmute every time they need Alexa to turn on a light or whatever people use it for.
Alexa *does* need an Amazon account though.
Yeah they are intuitive and easy-to-use and all, but that doesn't justify paying out of pocket just to be a data point in some algorithm that wants to sell me crap.
Crap software is the result of attempts by the underdogs to beat Amazon at their game - which they can't, because Amazon has the sheer size needed to actually effectively do the data mining game.
Well, if "mostly harmless" is the standard here, then I will await the Vogon construction fleet to fix the local space for that planned highway. This has, after all, the advantage of converting "mostly harmless" to "definitely no problem anymore".
Alternatively, we can limit ourselves to invite some Vogon poetry to be read to Alexa. It would probably sterilize the backing computers of all ability to record and reply. At least all Alexa enabled device owners will spontaneously kill themselves upon exposure to the exquisite Vogon verbal expressionism.
As shipped, you can enable voice purchases by voice.
My 3 year old daughter ordered several things and very nearly started a subscription before we found the setting to disable it.
While I was able to cancel them before they shipped, it was rather shocking.
Possibly I should have let them ship then returned them at Amazon's cost.
As a matter of interest, I did a quick web search and found a page that says "Alexa is always listening but not continually recording. It doesn’t send anything to cloud servers until it hears you say the wake word (Alexa, Echo, or Computer)"
This ties in with my understanding and observation of how they work. And if this is the case, then a lot of the concerns mentioned are based on mis-information (not that I am promoting them, just pointing it out).
Is anyone able to actually verify this ?
As a matter of interest, I did a quick web search and found a page that says "Alexa is always listening but not continually recording. It doesn’t send anything to cloud servers until it hears you say the wake word (Alexa, Echo, or Computer)"
I have this bridge here for sale...
We have one in our office of 10 people. It does get triggered by non Alexa related conversations, or when several people are on the phone at once (on headsets so they only hear their own conversation). So I think it is both listening at all times, and is set to have a stab at responding with somethng rather than holding back in the event of doubt.
> The threat model there involves a malicious person being close enough to connect to the speaker (Bluetooth range is about 10m); in that case you've got bigger problems than someone being able to remotely turn your dishwasher on.
Not necessarily. How about a burglar outside the house, bluetoothing in to get alexa to open the front door?
Assigning the label "smart" to these devices or these people is very problematic.
It would depend on whether your standard for comparison is the average fireplug, the average ad-monger or the average human.. No doubt Alexa is smarter than a fireplug. At least current model fireplugs. Next year? who knows? The average ad-monger? probably. The average human. No way.
Current "smart devices" look to have an IQ of about 70. At best. I have some doubts about how well Asimov's three laws -- e.g. A robot shall not harm a human ... -- will work with devices that probably don't understand the concept of human. Nor of "harm".
Current "smart" devices have ZERO intelligence. They're just pattern matchers and voice-input search engines that usually respond to the first result (including ads.)
Intelligence means it _understands_ what you're saying and chain together concepts from one sentence and one paragraph to the next, not just parse "Alexa, play funky music." :)
Ok, 10m sounds close - unless you live in an appartment complex (ceilings are ~2.5m high, neighbours on two or more sides, and above and below) or in one of those terraced houses that are about only 5m wide...
It does not have to be a burglar, a curious and maybe slightly mischievous teenager is all you need. We don't have shortage of those, I'd say (and considering it's a typical way of gaining actual IT knowledge rather than the usualy MS-Office skills taught in many places it is not entirely bad per se, but then they should please stick to their own devices - yeah, boring)
For the safety of others, put the crap back in the box it came in, and send it back. Even if you mention my name(which isn't uncommon) I don't want to be fingered!! If, however, you know what you are dong, put the fucker in the hopper! And stop thinking you can stop alexa and friends munching your data, my best effort is to limit it! You must be delusional... sorry dude, but reality sux!
Hey, this is awesome.
Now I don't even have to be physically present to run this test: https://xkcd.com/1807
After years of being an Alexa refusenik, I finally relented and got a few, which are registered with an Amazon account with no purchase ability. Whilst I lose some features because of that, it limits exposure. Mainly used for setting timers during cooking, intercom and answering the kids questions that "even Dad" didn't know. Of course soon they will just ask Alexa themselves, instead of Dad. Swings and roundabouts.
"and answering the kids questions that "even Dad" didn't know."
Allowing Amazon to start a dossier on your kids before they have enough sense to understand the phrase "personal privacy". Doomed to be marketed at incessantly for the rest of their lives without so much as a by-your-leave.
Nice.
"Swings and roundabouts."
More like bread and circuses,
You think Amazon can't tell the difference between voices on your account and create separate dossiers for each, eventually assigning them names (and the names of their friends, cross-referencing same), preferences, and who knows what else for each?
Note that on top of this, Amazon can (and does) follow your IP address as they/you pass through any and all web sites that use AWS. This is cross-referenced with the data you helpfully provide through your Alexa-thingy.
It's a multi-billion dollar international advertising corporation. That's what it DOES. If Amazon were human, it would be jailed for stalking. And you are not only enabling it, you are actively helping it invade the privacy of your children, before they have a choice in the matter.
I still refuse to have Alexa or any of its relatives in the house. I don't want any of them triggered by a "wake word" turning up in the middle of my opera.
Incidentally, I am on stage soon in "The Sorcerer" (Gilbert & Sullivan). One of the main protagonists is named Alexis...
There are 4 wake word options for Alexa, "Alexa,” “Amazon", “Echo", and “Computer". All easy for a digital system to accidentally interpret from everyday conversation. What you aren't allowed to do is set your own, with option for a pair of words. Also the easy opportunity of some basic voice ID matching has been avoided. Primitive when you know that fingerprint ID and face ID are now common. This is why I permanently keep the mic permanently switched off on my Echo, except for a moment to switch radio stations. I sit within reach of the device anyway.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
