News for hackers. Stuff that matters.
Re:Don't Buy Anyone an Echo by Someone1234 on Tuesday December 05, 2017 @12:00PM (#15853095)
This quote about half way down largely unravels this article's central point:

> microphones only send recordings to the servers when you use the wake word.

This is a fact we can verify with tools like Wireshark. Their other point about "open microphones" largely ignores smartphones which all have open microphones and a baseband operating system which can activate the microphone to spy (which the NSA did[0]).

Their point about existing hacks targeting the Echo is also largely unraveled by a quote further down:

> This particular exploit only worked on devices made before 2017 and required the hacker to have physical access to the Echo.

Essentially if you disassemble an Echo and reprogram it, it will do something else. Compelling stuff...

[0] https://www.wired.com/2014/06/nsa-bug-iphone/

Re:Don't Buy Anyone an Echo by dgritsko on Tuesday December 05, 2017 @12:10PM (#15853213)
Perhaps only tangentially related, but your comment reminded me of one of my favorite quotes from Charles Babbage, regarding his analytical engine:

> On two occasions I have been asked, — "Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?" In one case a member of the Upper, and in the other a member of the Lower, House put this question. I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question.

https://en.wikiquote.org/wiki/Charles_Babbage

Re:Don't Buy Anyone an Echo by tialaramex on Tuesday December 05, 2017 @12:53PM (#15853778)
Note that Babbage has the wrong end of this.

Part of Google's success is realising that yes, your goal needs to be that the right answer comes out when asked the wrong question. If you type "Rebecca Editor of Star Newspaper" it doesn't matter that's not how she spells her name, or that she was never editor of the Daily Star, nor that she's not now editor of anything at all, having been effectively promoted, Google correctly determines that you probably want results about a famous British woman named Rebekah Brooks.

There's an SF story, I thought it was a Multivac story but a list of those doesn't find it for me, where the world computer has been making "mistakes" and the technicians trying to diagnose it eventually realise its "mistakes" are actually causing humans who've disobeyed its instructions to fail. The computer has been tasked with improving efficiency, and disobedience results in inefficiency, so it has arranged for those who are disobedient to be unsuccessful. It isn't murdering anybody, but maybe they'll go bankrupt or miss out on a promotion and so the overall inefficiency is reduced.

Re:Don't Buy Anyone an Echo by burger_moon on Tuesday December 05, 2017 @01:05PM (#15853940)
Can you explain what this means? I don't understand what the person you're quoting is saying.
Re:Don't Buy Anyone an Echo by dgritsko on Tuesday December 05, 2017 @01:18PM (#15854086)
Charles Babbage is referring to two separate occasions upon which he was asked if his "analytical engine" (what some might consider the first computer) would still produce the right answer to a problem even if the wrong input was supplied. The answer is so painfully obvious -- of course it won't! -- that Babbage remarks that he can't even understand how confused the person must be in order to ask such a question.
Re:Don't Buy Anyone an Echo by openasocket on Tuesday December 05, 2017 @01:16PM (#15854067)
In addition to Wireshark, we have pretty strong legal evidence. When Amazon was made to provide whatever recordings they had from the Echo in that homocide case, they said they only record the commands given and don't have an always-on microphone. If that was not the case, Amazon would be committing a major crime to cover up such a feature.

Disclaimer: work for AWS, not affiliated with Alexa or Echo.

Re:Don't Buy Anyone an Echo by tree_of_item on Tuesday December 05, 2017 @12:16PM (#15853286)
> This is a fact we can verify with tools like Wireshark.

Is it really? I don't think you'd be able to detect steganographic communication or targeted attacks like this.

Re:Don't Buy Anyone an Echo by Someone1234 on Tuesday December 05, 2017 @12:27PM (#15853406)
It could detect an open microphone, which is the topic.

The microphone's input would either need to be transmitted continuously (which is detectable with Wiresharp or other traffic monitoring tools), or stored which neither the Echo or Echo Dot have large enough capacity to do for any significant length of time.

Re:Don't Buy Anyone an Echo by gambiting on Tuesday December 05, 2017 @12:46PM (#15853684)
You can get really great quality voice audio taking as little as 2KB/s(I work with VOIP solutions so I have some idea). At that rate, that's 168MB/24 hours. But then if you consider that you only need to record when someone is actually talking(don't record below certain threshold) you probably only need to store 5-10MB of data a day. You can just write that much to ram, I'm sure Echo has enough to do that. Then upload data periodically when someone sends an actual command to the server.
Re:Don't Buy Anyone an Echo by raisedbyninjas on Tuesday December 05, 2017 @12:50PM (#15853736)
Presumably there is enough silicon onboard to keep a tally of interesting keywords, compute a very rough terrorism score and upload that once a month. Three letter agencies could follow-up with additional measures for those that pass a threshold.
Re:Don't Buy Anyone an Echo by beckler on Tuesday December 05, 2017 @12:49PM (#15853723)
Wireshark could see the packets moving across the network, but you might have issues seeing the payload. More so if the echo does certificate pinning.
Re:Don't Buy Anyone an Echo by marzell on Tuesday December 05, 2017 @01:39PM (#15854359)
Also, there's no reason that such packets would have to be sent immediately. It's totally possible that, during times when a wake-word is not utilized, they could still record, compress, and delay transmission of recordings until a less conspicuous time (middle of the night, weekend, following a reboot, or in tandem with the next 'expected' transmission).
Re:Don't Buy Anyone an Echo by banterfoil on Tuesday December 05, 2017 @02:31PM (#15854952)
I'm not choosing a side here, but saying "we have Wireshark" doesn't mean as much as you think it does. If packets are encrypted and sent at arbitrary times, we really have no idea what is being communicated. Surely we could see large amount of data if they were transferring entire audio sessions, but I feel like they are far more likely to send transcripts or key word mentions. Given the size of keyword mention, it would be very hard to distinguish this from a normal query to Google.
Re:Don't Buy Anyone an Echo by ajford on Tuesday December 05, 2017 @04:20PM (#15856116)
The problem with that is processing power. If the Echo could do speech to text without the cloud (such as generating that transcript you mention), then it wouldn't need the cloud in the first place.

I'll give you that it could be possible to slip in other "trigger words" that could be tallied, then statistics sent off, but really, is that a problem? So what if your Echo counts how many times you say a specific keyword? Would that affect your life in any way?

Re:Don't Buy Anyone an Echo by bb88 on Tuesday December 05, 2017 @02:41PM (#15855065)
Can't one just profile "Ok Google what is the temperature" versus the television being on? Or Music being played in the background?

it seems like it wouldn't be that hard to get some datapoints about what google might be sending based upon when transmissions were sent and what was being sent to the microphone.

Or just find someone smart enough to reverse engineer the device.

Re:Don't Buy Anyone an Echo by singularity2001 on Tuesday December 05, 2017 @12:21PM (#15853332)
can Wireshark detect when hostile agencies distribute steganographic information over other https packages?

Your “phones can already do this” argument still holds

Re:Don't Buy Anyone an Echo by singularity2001 on Tuesday December 05, 2017 @12:23PM (#15853355)
what is the name for arguments of the kind “Russia can already nuke us, so let's allow Iran and Kim bombs too”?
Re:Don't Buy Anyone an Echo by jim-greer on Tuesday December 05, 2017 @01:06PM (#15853956)
So an Echo is as dangerous as an iPad. Sure, but enough with the FUD.
Re:Don't Buy Anyone an Echo by pbhjpbhj on Wednesday December 06, 2017 @05:58AM (#15860154)
It's on the cusp of Sunk Cost, Fallacy of Inertia, and Fallacy of Relative Privation.

The last one is probably closest but it doesn't matter because there are starving children to feed and you're here worrying about names of fallacies, you animal. /s

Re:Don't Buy Anyone an Echo by adamio on Tuesday December 05, 2017 @01:04PM (#15853924)
Maybe survivorship bias