Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Amazon Echo. Show all posts
User Security
Amazon Echo Google Smart Speakers Smart Devices Technology Technology News User Security

'Paranoid' Blocks your Smart Speakers from Spying on you


Smart speakers have proven to be one of the most versatile gadgets of the era, the high-tech AI companions can do everything from playing music to ordering a meal with just the sound of your voice. They come with virtual assistants ready to answer all your queries, other features include reminding you of appointments, telling about the weather and news along with helping you to control your smart home devices.

Amazon's Echo and Google's Nest are two of the widely employed smart speakers. However, these devices also raise security concerns in regard to the voice captured by the speakers but in order to avail services of a voice assistant that as a matter of fact operates on voice commands, you can't block it from listening to your voice.

To make the experience easier and safer, a new device known as 'Paranoid' is made to enter the tech space, it is designed to block your Amazon Echo or Google Home smart speaker from listening to your voice until you say the word, "Paranoid" which is the device's wake word. After saying the word, the gizmo allows your smart speaker to listen.

Another thing to take notice of is the simplicity in the operations of Paranoid, it's extremely easy to use, it simply needs to be connected to the smart speaker in order to block it from spying upon you –meanwhile,  it still allows the speaker to be voice-activated. In order to activate it, all you have to do is to say "Paranoid" every time before you say "Okay, Google!" or "Alexa!"

The device comes in three different variants, The Home Button, Home Wave, and Home Max. It has no antenna, no SIM card slot, no Bluetooth, no Wi-Fi and no kind of wireless capability. As per its website, the makers claim that their device is "hack-proof".

The Home Button is the simplest model, it is placed on Amazon Echo's mute button and presses it manually. The second one, the Home Wave is designed to jam the microphones on your smart speakers and the most sophisticated one, the Home Max requires you to send your Amazon Echo or Google Home Devices to Paranoid headquarters stationed at Edmonton, Alberta. There, experts will attach your speaker's microphone cable to an external Paranoid device by cutting off the original cable. After the completion of the process, your smart speakers will be sent back to your address.

All the three models of Paranoid can be purchased from its official website; the original charges of the device and services are $49, however, as of now it will cost only $39.
Read more »
Technology
Alexa Amazon Echo Technology

Wi-Fi Bug in Amazon Echo and Kindle Devices Assist Attackers in Stealing Sensitive Data


There is no denying the fact that Amazon Echo and Kindle devices are extremely popular and are utilized by a large number of users around the world. The news, therefore, comes as a huge shock to those millions of users that some researchers from ESET Smart Home saw that Amazon Echo and Kindle Echo are vulnerable against KRACK attacks.

The KRACK attacks, discovered and published by two Belgian researchers in October 2017 are based on the weaknesses in the WPA2 protocol utilized in modern-day Wi-Fi devices.

The weakness is said to have been exploited by the attackers utilizing key reinstallation attacks if the victim resides within the system and the successful exploitation of the attack enables attackers to steal sensitive details, for example, credit numbers, passwords, chat messages emails, photos, etc.

Researchers tried the first generation of the Amazon Echo devices with original Amazon Alexa as well as the eighth generation of Amazon Kindle and concluded that they are vulnerable against two KRACK vulnerabilities.

With KRACK scripts, ESET researchers ready to "replicate the reinstallation of the pairwise encryption key (PTK-TK) in the four-way handshake (CVE-2017-13077) and reinstallation of the group key (GTK) in the four-way handshake (CVE-2017-13078).”

As per the ESET team, the vulnerabilities enable the attackers to Replay old packets to cause a DOS attack or interferences.

  • Unscramble the data transmitted. 
  • Attackers can likewise forge packets. 
  • It can even steal sensitive details, like passwords or session cookies.

Nonetheless, Amazon has acknowledged the issue as soon as the vulnerabilities were accounted for to it on October 23rd, 2018 and to do that Amazon distributed another version of software application wpa_supplicant that is responsible for the correct authentication to the Wi-Fi network.

Read more »
Vulnerability
Amazon Echo Hacking Privacy Breach Vulnerability

Flaw In the Amazon Echo; Allows Hackers to Listen In To Users’ Conversations





Security researchers from the Chinese tech giant Tencent as of late discovered a rather serious vulnerability in Amazon Echo. The vulnerability is termed serious on the grounds that it enables programmers to furtively tune in to users' conversations without their knowledge.

The researchers in a presentation which was given at the DEF CON security conference, named ' Breaking Smart Speakers: We are Listening to you,' and precisely explained as to how they could assemble a doctored Echo speaker and utilize that to gain access to other Echo devices.

'After several months of research, we successfully break the Amazon Echo by using multiple vulnerabilities in the Amazon Echo system, and [achieve] remote eavesdropping. When the attack [succeeds], we can control Amazon Echo for eavesdropping and send the voice data through network to the attacker.'

Researchers utilized Amazon's Home Audio Daemon, which the device uses to communicate with other Echo devices on a similar Wireless connection, to ultimately control the users' speakers. Through which they could quietly record conversations or even play random sounds.

The attack though, is the first one that the researchers have distinguished a noteworthy security defect in a well-known smart speaker such as the Amazon Echo. The researchers have since informed Amazon of this security imperfection and the firm said it issued a software patch to the users' in July. They likewise note that it requires access to a physical Echo device.


In any case, Amazon and the researchers both warn that the technique distinguished is extremely modern and in all probability is easy for any average hacker to carry out. 'Customers do not need to take any action as their devices have been automatically updated with security fixes,' says an Amazon spokesperson.

Yet, some have brought up that the attack could also be carried out in regions where there are multiple Echo devices being utilized on the same network, the simplest example of it are the Hotels or Restaurants.

Nonetheless prior this year, researchers from University of California, Berkeley too recognized a defect where hackers could not only control prominent voice assistants such as, Alexa, Siri and Google Assistant but could also slip indiscernible voice commands into audio recordings which could further direct a voice assistant to do a wide range of things, that range from taking pictures to launching websites and making phone calls.

Read more »
Security defect.
Amazon Echo Maltreatment Security defect.

Researchers Turn Amazon's Echo into an Eavesdropping Device.



Researchers at the cybersecurity firm Checkmarx have figured out a way on how to transform an Alexa-powered Amazon Echo smart speaker into an eavesdropping gadget.

They made utilization of the choices accessible in the Alexa software development kit (SDK) that are usually made accessible to Alexa app engineers rather than making use of the exposure in the Echo device  or Alexa service.

The researchers maltreated several Alexa SDK features like skills, intents, slots, reprompts, or end session parameters. These are the specialized technical terms and researchers clarified what they meant and how they consolidated them in a two-page report.

In a basic clarification, the Checkmarx group says that it utilized the Alexa SDK to make a calculator application that keeps on tuning in constantly in order to give the user an answer to their underlying inquiry.

They also maltreated a parameter called "shouldEndSession," which they set to false, which means the malignant calculator application would expect a second question from the user, directly after the answer of the first, and all this would happen without requiring the user to say “Alexa, open calculator."

By its design, Alexa stayed open and recorded all the encompassing sound, expecting the second question. Innately, this implied Alexa was deciphering all sound into words stored inside the so-called slots/openings, obvious to the application developer in the application's logs.

The Developers did not stop here though, they went on ahead to further mishandle an Alexa SDK parameter called "reprompt," which is usually utilized by applications to incite the user to rehash their information. Combined with the "shouldEndSession" parameter that advised Alexa to silently tune in for the second inquiry, this broadened the account interim by an additional 8 seconds to a sum of 16.

Researchers later said that they unveiled this profiteering situation to Amazon Alexa developers, who worked and went on to release defensive measures for protection purposes.

As indicated by the researchers, Amazon revealed an Alexa update that identifies empty reprompts and longer-than-normal sessions, all the while taking proper actions.

This is however, not the first main security defect influencing Alexa gadgets. Alexa was known additionally to be influenced by the BlueBorne weakness and also back in September, 2017, the researchers unveiled DolphinAttack, an approach to take control over smart home speakers like Echo while utilizing ultrasounds.

The link given below is of the demo video that shows how such a hack will be carried out, and just how hard  it would be for the user to spot it.

 https://youtu.be/xfx90UJ4qGU

Read more »
Subscribe to: Posts (Atom)