Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Hardware

Hackers Can Turn Amazon Echo Into a Covert Listening Device (helpnetsecurity.com) 114

Posted by BeauHD from the always-listening dept.
Orome1 shares a report from Help Net Security: New research released by MWR InfoSecurity reveals how attackers can compromise the Amazon Echo and turn it into a covert listening device, without affecting its overall functionality. Found to be susceptible to a physical attack, which allows an attacker to gain a root shell on the Linux Operating Systems and install malware, the Amazon Echo would enable hackers to covertly monitor and listen in on users and steal private data without their permission or knowledge. By removing the rubber base at the bottom of the Amazon Echo, the research team could access the 18 debug pads and directly boot into the firmware of the device, via an external SD card, and install persistent malware without leaving any physical evidence of tampering. This gained them remote root shell access and enabled them to access the "always listening" microphones. Following a full examination of the process running on the device and the associated scripts, MWR's researchers investigated how the audio media was being passed and buffered between the processes and the tools used to do so. Then they developed scripts that leveraged tools embedded on the device to stream the microphone audio to a remote server without affecting the functionality of the device itself. The raw data was then sampled via a remote device, where a decision could then be made as to play it out of the speakers on the remote device or save the audio as a WAV file. The vulnerability has been confirmed to affect the 2015 and 2016 editions of the device. The 2017 edition of the Amazon Echo is not vulnerable to this physical attack. The smaller Amazon Dot model also does not carry the vulnerability. More technical details can be found here.
This discussion has been archived. No new comments can be posted.

Hackers Can Turn Amazon Echo Into a Covert Listening Device More

Hackers Can Turn Amazon Echo Into a Covert Listening Device

Comments Filter:

  • News! (Score:5, Insightful)

    by Ol Olsoc ( 1175323 ) on Tuesday August 01, 2017 @05:42PM (#54922407)
    This is like saying that hackers can turn a car into a transportation device.

    • Hackers can turn your laptop camera into a surveillance device, this has been foiled by smart people with tape.

      Echo and Google Home users should submerse their devices in a bucket of oil when not in use; please don't use water as this may cause a power short.

      • Re:News! (Score:5, Insightful)

        by ShanghaiBill ( 739463 ) on Tuesday August 01, 2017 @06:05PM (#54922503)

        The "hack" described in TFA requires physical access to the device. Anything can be compromised by someone with physical access. For instance, I can "hack" the smart-lock on your front door with my sledgehammer.

        • Can you hack space time? You have physical access. Where's your teleportation device? Your time machine?

          DIDN'T THINK SO.

          • If YOU made a time machine, would YOU tell anybody?

            DIDN'T THINK SO.

            • Re: (Score:3, Funny)

              by Buchenskjoll ( 762354 )
              Of course I would. And every time I would say "I told you so yesterday!", and then go back and do it.

              • Of course I would. And every time I would say "I told you so yesterday!", and then go back and do it.

                And you could have changed your present. Then you may not be able to say "I told you so yesterday!" because the person may not see or talk to you again.

            • If YOU made a time machine, would YOU tell anybody?

              DIDN'T THINK SO.

              Not intentionally, but that shit can't be kept secret.

              FACT: The reason we don't have backwards time travel is because it's always eventually used to go back in time and prevent it from ever being invented.

              • I'm pretty sure I eventually invent time-travel, and spend the rest of my life carefully guiding myself to the discovery faster and cheaper than I had originally done. In fact, I bet soon I'll find a way to stop myself from writing this slashdot post.

          • Re: (Score:2)

            by thomn8r ( 635504 )

            Can you hack space time?

            By whacking you in the head with the same hammer, I can magically transport you 30 minutes into the future.

        • Re: (Score:2)

          by LesFerg ( 452838 )

          Exactly. If a "hacker" gained that much access to a device inside your house, they could just as easily plant their own bug inside that or any other appliance or household decoration.
          How is this new or surprising? Is this just propaganda in support of EUFI?

        • I could turn your completely offline device into a covert listening device if I had access to it for 5minutes.

          This has been the stuff of spy agencies since they first existed.

        • To say that anything can be hacked if you have physical access is taking things too far. It greatly increases the odds, but there are countermeasures that can be employed. It is even possible to make a device that literally canot be hacked, even by state actors, so long as it is a "one off" implementation. As always, security isn't a product so much as a set of procedures and processes, and what is important is the security landscape. Should a typical user be worried? Probably not. Should a user with a jilt

          • Re: (Score:1)

            by jamlam ( 1101193 )
            Not really... I'm fairly certain that no government could build a device that I couldn't turn into a listening device by sticking a wifi mic to it. Similarly with the Echo, if you take off the baseplate, remove everything inside and replace it with a recording device does that really constitute hacking? You've not compromised the security features of the device, it was never designed to be secure if left in a public place. I think the question is whether doing something physical to change the device really
            • You would be wrong. In fact it is trivially easy to build a device that knows what Wi-Fi devices are in range and reports the presence of any new ones. Care to try again?

              • Re: (Score:1)

                by jamlam ( 1101193 )
                Who says I'm using WiFi (apart from me in my previous comment but you get the idea...) https://en.wikipedia.org/wiki/... [wikipedia.org]
                • Try 2: Fail. The same applies to any device that radiates energy, including heat. Care to try a third time? (It is 2017 now, BTW)

                  • Re: (Score:1)

                    by jamlam ( 1101193 )
                    Kinda veering off topic here a little, the statement was that a government could make something that was totally physically secure, not that it was possible to create an undetectable listening device. Any listening device that transmits information radiates energy by definition so I call straw man on that one.
                    • You created the straw man, but I already showed why you are wrong. By using the Echo there is no new device to detect. You seem to have missed that point entirely in your misguided zeal to prove my factually correct OP wrong.
                    • Not quite zeal, I'm on the train and I'm bored and this is quite interesting :) I agree that it's harder to detect in terms of the Echo but your statement was "To say that anything can be hacked if you have physical access is taking things too far". That's the factually incorrect bit, if you'd said "it's impossible to create an undetectable transmitting device" I'd have agreed 100%.
                    • You forgot the restriction that it has to be a "one off" item. There are techniques to make device tamper proof. If you open them they will never work again, etc.

        • The "hack" described in TFA requires physical access to the device. Anything can be compromised by someone with physical access.

          This is true, but the attack on the Echo appears to be unnecessarily easy. Debug pads should not be left enabled in production devices.

          • This is true, but the attack on the Echo appears to be unnecessarily easy. Debug pads should not be left enabled in production devices.

            FUCK THAT. Debug pads should be left enabled in ALL DEVICES. That's needed for the ability to make many types of repairs and modifications. It's irrelevant because the manufacturer leaves them there on purpose, so that they can troubleshoot and analyze problems in devices returned by customers. Not so that they can repair and resell them, although they may actually come in handy for that purpose as well, but so that they can figure out what they did wrong and fix it in the next revision.

            It has always been a

            • This is true, but the attack on the Echo appears to be unnecessarily easy. Debug pads should not be left enabled in production devices.

              FUCK THAT. Debug pads should be left enabled in ALL DEVICES.

              I completely, and deeply, disagree, at least on any device that manages sensitive user information.

              • I completely, and deeply, disagree, at least on any device that manages sensitive user information.

                Security through obscurity is not security. It's false.

      • >"Echo and Google Home users should submerse their devices in a bucket of oil when not in use;"

        Consumers should just insist on all such devices having a PHYSICAL microphone OFF button. It really is that simple. Of course, many won't use it, and it doesn't protect from malware having access to when it is being actively used. But at least it is a start. It gives the user the ultimate control, without having to TOTALLY physically remove power from a device (rendering it completely useless; and that isn'

    • Re:News! (Score:5, Informative)

      by Daetrin ( 576516 ) on Tuesday August 01, 2017 @05:47PM (#54922427)
      I'm shocked. Shocked i tell you. This is my shocked face. For some reason it looks very similar to my sarcasm face.

      • Re: (Score:1)

        by Anonymous Coward

        Are you telling me hackers can turn your sarcasm face into your shocked face?

    • Re: (Score:1)

      by Anonymous Coward

      Breaking news: attackers with physical access to a device are able to compromise the device. Literally everyone in the tech industry is shocked by this discovery.

      Congress is already moving to pass legislation forcing the US to revert to the stone age in order to protect the country against terrorism and pedophiles, though it has little support from the Republican party who insist it include provisions to lower taxes, nor does it have support from the Democratic party because the bill has nothing to do with

    • The key word isn't "listening device", it is "covert". Hackers can turn an overt listening device into a covert listening device. Kinda like how Android malware can turn your Google/AT&T spying device into a Google/AT&T/other spying device.

      • The key word isn't "listening device", it is "covert". Hackers can turn an overt listening device into a covert listening device. Kinda like how Android malware can turn your Google/AT&T spying device into a Google/AT&T/other spying device.

        The keyword isn't covert. It is that the device listens, and as a part of the security lacking Internet of things someone or many people out there simply are listening to it. I don't give a damn if you call it onomatopoeia, the gaddamned thing is listening in all the time. And the utter naivety to think that the only people who are listening to it is Amazon is charming, but so wrong. Maybe that isn't a big deal for many people.

  • "Amazon Echo still a covert listening device"

  • Holy Possessed Toaster (talkie anyone) (Score:5, Insightful)

    by brokenin2 ( 103006 ) on Tuesday August 01, 2017 @05:48PM (#54922435) Homepage

    How many average consumer devices can't be compromised with physical access to the hardware?

    Couldn't someone also just plant a bug in the thing (or somewhere else in your house) and listen to you that way?

    In what world is this news?

    • Re: (Score:2)

      by brunes69 ( 86786 )

      Indeed.

      And in fact, *IF* you were a three letter agency and you had physical access to someone's house, and wanted to spy on them, which are you more likely to do - spend hours disassembling the Echo and doing this exploit and reassembling it, or spending 10 minutes planting bugs all over the house? I would wager the latter.

    • Re: (Score:2)

      by Vektuz ( 886618 )
      If you had physical access you could just plant an actual covert audio listening device in the house instead.

    • Re: (Score:2)

      by Kjella ( 173770 )

      How many average consumer devices can't be compromised with physical access to the hardware?Couldn't someone also just plant a bug in the thing (or somewhere else in your house) and listen to you that way? In what world is this news?

      Well, it's a nice spy trick to subvert the enemy's equipment instead of installing your own bug. If it was a cell phone, video conference system or something like that I'd say it was a pretty big deal. I just don't see the overlap between the kind of places you'd worry about a bug sweep and the kind of places you'd put an Amazon Echo though. Though it could be Trump has got one at the White House...

    • There are many already in place, no bug scan will find it, and all the infrastructure for remote monitoring is already there. There are numerous advantages over your "just plant a bug" approach.

  • Why buy this crap? (Score:5, Insightful)

    by DatbeDank ( 4580343 ) on Tuesday August 01, 2017 @05:48PM (#54922437)

    Always listening device,

    Who in their right mind thought these tools would be useful to a consumer? Are people out there really that dense to think that a device like this isn't sending every waking minute of their lives to some spook at the NSA?

    Every time I hear someone go on and on about how the "Internet of Things" is the next great land rush, I laugh. The sooner this and 360 VR die the better.

    • cellphone is already doing it, at least Alexa will tell you a joke

    • AND on top of it they are getting you to PAY for it. Tom Sawyer and whitewashing the fence all over again.

    • Always listening device,

      Who in their right mind thought these tools would be useful to a consumer?

      The same can be said of many consumer devices that wound up being successful. When the iPad first came out, people mocked A) the name, and B) the idea that anyone would want an overgrown iPhone that can't make phone calls. No-one mocks it anymore. In the case of the Echo, being able to give verbal commands to a computer rather than mess about with a keyboard has long been a feature of science fiction that many people wanted in reality. That many people have their doubts about the usefulness, reliability and

    • Who in their right mind thought these tools would be useful to a consumer?

      Given digital assistants are the wet dream of pretty much every sci-fi writer, you are just showing a lack of imagination.

    • Re: (Score:3)

      by Ksevio ( 865461 )

      Are people out there really that dense to think that a device like this isn't sending every waking minute of their lives to some spook at the NSA?

      For a tech site, you wouldn't expect questions like that. I have one, it's handy for asking questions, controlling the lights and stuff.

      I also have monitored the traffic from it and there's nothing significant until you say the wake word. Might as well be afraid of your toaster sending data to the NSA.

  • If hackers turn all mobile phones into global echolocation surveillance system, that is going to be way more interesting. Do you ever ask yourself how google gets information about traffic jams? Every mobile phone is being tracked. What is the point to hack Amazon Echo when we have mobile phone in every pocket?

    • Re: (Score:1)

      by Anonymous Coward
      Jokes on all of you with smartphones, I refuse to own one, have a $50 plastic clamshell phone, and it's turned on only once or twice a day for a couple hours.
      • Yes, you are the exact person who is being monitored by surveillance systems. You have more chances to stay hidden being at the spot of public attention. As soon as you try to hide yourself in the cave you get only more attention from surveillance systems, because you just go beyond average statistical behavior.

    • Do you ever ask yourself how google gets information about traffic jams? Every mobile phone is being tracked.

      Only phones that have opened google maps and told it to get their location are tracked for traffic. Pretty easy to avoid that.

      • >"Only phones that have opened google maps and told it to get their location are tracked for traffic. Pretty easy to avoid that."

        Actually, that is not true. A lot of the traffic information comes from the cell companies which track all the phones BY NECESSITY and then sell that information (supposedly ananoymized) to third parties. I know that Sprint does it, and I doubt they are alone. They don't tell you and don't ask your permission. If your phone is on and the mobile radio is on, you ARE being tr

    • It would be pretty hard for a cellular network to work without tracking the devices connected to it.
      • I know. I personally believe that public alert systems should be built into mobile phones. So government agencies can make loud voice announcements directly to mobile phones whether user wants it or not. Going further government agencies should be able to communicate with people via speakerphone with people who are close to phone as well. I assume that they are doing this anyway, I only consider that information obtained this way should be used only for public safety and cannot be used against the user in a

  • Once again (Score:5, Interesting)

    by NEDHead ( 1651195 ) on Tuesday August 01, 2017 @06:07PM (#54922507)

    Star Trek had it right. First you poke the button on the communicator, then it listens...

    • Re: (Score:2)

      by vux984 ( 928602 )

      Actually no, what makes you think the star trek system can't also be trivially hacked* to listen all the time?

      * I wrote 'hacked' but I'm willing to bet "hey computer, quietly record everything going on everywhere on decks 1 - 15 and deliver it to my console" would also work; so more of a 'built in functionality' rather than a 'hack'.

    • Button press unnecessary when on board the Enterprise.

    • Star Trek had it right. First you poke the button on the communicator, then it listens...

      Except for the hundreds of times when the actor forgets to touch the communicator until halfway through his/her utterance.

    • Star Trek had it right. First you poke the button on the communicator, then it listens...

      That is the way that these devices work, too, when they're not hacked. The only difference is that the "button" is a keyword.

      Actually, Star Trek had that as well. The keyword was "Computer".

  • From the institute of (Score:3)

    by Snotnose ( 212196 ) on Tuesday August 01, 2017 @06:19PM (#54922531)
    No Shit Sherlock.

    Back in '90 or I was sysadmin when we got a bunch of personal Sun workstations. These all had microphones on them, Usenet soon told me how to turn the mic on and record to a local file. Went to my boss, told him we needed to open up every box and cut a wire. He was all like "um, no, not gonna happen". Told him to wait 5 minutes, then call someone and talk for a minute or two. Went into his office, played back the audio file I'd recorded of his conversation, spent the next few hours opening up brand spanking new Sun workstations to cut a wire.

    Why yes, I do have black tape over the camera on my laptop. Why do you ask?

  • While yes, physical access to a device means it *can* be hacked, there are different degrees of concern you should have, depending on the device in question.

    For example, physical access to my car in order to hack it? The car does have door locks on it as well as requiring a separate key to actually start it. Most people have a habit of doing some basic physical security with their car - such as putting it in a garage at night (which is also locked), or at least locking it up and taking the keys with them wh

    • It could be compromised before the box even arrives at your house. For that matter it could even be compromised before it leaves the factory.

    • If you're inviting CIA agents to your country's embassy for an evening party, then yes, you should keep a careful watch on your Amazon Echo.

    • Looking at the effort involved in this... if a guest is in your living room... and may have motivation to spy on you... They could A. Take appart your echo, plug in their SD card with malware, put back together the echo, it still looks like about a 5-10 minute job. B. Put a tiny bug that they got at the spy store, pretty much anywhere in the house... in about 5-30 seconds.

    • Re: (Score:2)

      by Ksevio ( 865461 )
      In the article they had to partially dismantle it and connect wires to debug pads. Sure you wouldn't know after it's done, but it would look very suspicious to anyone around. Would be much more subtle to place a standalone bug.

  • "Turn"? (Score:3)

    by Dialecticus ( 1433989 ) on Tuesday August 01, 2017 @06:27PM (#54922565)
    You mean from an overt listening device? You could do that just by throwing a towel over it.

  • Never Leave It Alone (Score:1)

    by Anonymous Coward

    This is why I never leave my Echo unattended....especially at a DefCon conference.

  • It is usually considered that if you have access to a device, you can take control of it.

    If we call that a hack that must be fixed, then I fear the solution is more closed software, and repair-hostile hardware.

  • Why worry about things like government attacks on end-to-end encryption [slashdot.org], when everybody and his dog is signing up for 'personal assistants', installing Smart TV's and IOT devices, and posting their whole lives on social media? The vast majority of people seem to be in the process of making wholesale violations of their own privacy trivial and commonplace - it seems unlikely that they'll give more than five seconds' thought to some security vulnerability in the latest bit of shiny. Damn the bread and circuse

  • sheesh, i would never think for a second that a device that listened all the time to what was going on around it could be turned into a listening device! Almost like it was designed with that in mind...
  • They did that for the Blü phones due to the same reason.

  • Jeez, back in the day these threads would be full of all the projects people were going to do with commercial hardware once somebody found a way to load new firmware onto it.

  • Give me 5 minutes with a desk lamp back in the 1980s and I'll have turned it into a covert listening device as well.

    The people freaking out about this should look into what the FBI and CIA actually did before the internet (hint: still listened into people).

    • Yeah but now they don't need to bug your house, since everyone even pays for the bugs.

      • Yeah but now they don't need to bug your house, since everyone even pays for the bugs.

        Yes, they do. This hack requires physical access to the device. It's essentially the same. Now if they could perform the hack remotely....then it's different.

    • ...to put a discrete bug in your house you need some way to get the audio or video out of your house and into the hands of the attacker. Thus, they need physical access and a means to transmit data. If you want to transmit data a long way, you also need to take care of powering the bug in some way, as batteries won't last long. They need to put all of that in a central position in your house so they can actually capture the audio they want.

      Once you've conveniently tuned your Echo to your wifi, you've handed

  • How do you hide the Echo listening device by hacking it?

  • This is NOT new news. So, this old news attention on SlashDot must have another agenda.

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (10) Sorry, but that's too useful.

Close