Alexa hacks itself: vulnerability in Amazon’s Echo speakers!

According to the study, it is sufficient to pair a smartphone with an Echo speaker via Bluetooth. To do this, it is necessary to be in the immediate vicinity of the device once in order to set up the connection via voice command. Once that is done, the attacker can move away again and only has to remain within the radio range of the Bluetooth connection. Using a text-to-speech app, he is then able to issue voice commands through the Echo device’s speaker. If they start with the activation word “Alexa” or “Echo”, the assistant listens to herself when speaking – and does what she says.

Alexa, open the door for burglars

For example, if Alexa gives the command to open a smart door lock, burglars can gain access to a house without swinging the crowbar. The researchers were also able to execute commands that are secured by a confirmation prompt by appending a simple “yes” about six seconds after the first command. In this way, it was possible to switch smart networked lights on and off in 93 percent of all cases. Ordering goods via Amazon worked even better with a hit rate of 100 percent.

It managed to persuade Alexa to dial a specific phone number with a reliability of 73 percent. This allowed the attackers to call themselves and sound out their potential victims’ homes. The possibilities for abuse are almost endless, since almost every smart home component can be controlled via Alexa. In another test setup, the initiators of the study managed to get an echo loudspeaker to execute defective commands via a manipulated radio transmitter. However, Amazon has now fixed this vulnerability.

Vulnerability persists