Re:Project Alias hacks Amazon Echo and Google Home to protec...
by monsieurbanana on Monday January 14, 2019 @04:40PM
(#18906794)
> To suggest that a serial root console is a point of attack for an Echo device is bordering on insanity.
That was not what he said. He argues that Amazon/Google could remotely use a similar exploit (without direct access to the hardware) to start recording without lighting up the LED.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by jhall1468 on Monday January 14, 2019 @07:07PM
(#18907802)
Nobody has EVER gotten root console access on an Echo device remotely, and the only successful "remote" exploit that didn't require soldering requires that the attacker and the victim are both on the same wifi network.
Please, feel free to explain how Amazon and Google could exploit that vulnerability (that has since been patched)? More importantly, I'd love to hear how they are going to pull this off and hide it, given network traffic will be a dead give away?
If what your suggesting is actually what he meant, that's even more absurd than attackers trying to do the same.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by XMPPwocky on Monday January 14, 2019 @07:10PM
(#18907817)
I'm quite confident Amazon has remote root on every Echo device. It's called a firmware update.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by jhall1468 on Tuesday January 15, 2019 @11:34AM
(#18912372)
True enough. They could easily push a new update that would record every single thing you say, and despite not indicating anywhere on the device, it would take a matter of minutes before it was in the news because what they certainly can't do is hide network traffic.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by XMPPwocky on Tuesday January 15, 2019 @12:01PM
(#18912634)
Right, the bigger concern for me is targeted attacks. One user, especially a non-technical user, getting a "special" update pushed out.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by dogecoinbase on Monday January 14, 2019 @11:25PM
(#18908848)
As indicated in your previous comments, e.g. https://news.ycombinator.com/item?id=18616219 , you work for Amazon. It would be a better look if you disclosed this openly when commenting about Amazon.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by jhall1468 on Tuesday January 15, 2019 @11:35AM
(#18912382)
It's easily located in my post history, however, I don't work with anything even remotely related to the Echo devices. My interest in this discussion is as a user, not as an employee.
Re:Project Alias hacks Amazon Echo and Google Home to protec...
by heavyset_go on Thursday January 24, 2019 @05:07PM
(#18993531)
It's an ethics issue. You have vested interest in Amazon's public perception as an employee. You can't try to divorce your comments from your relationship with Amazon and expect to still be taken seriously.
A simple disclosure would have lent your comments more credibility.
Echo devices only begin recording if they think they hear the wake word. Obviously this is less than straight-forward, hence the recordings that didn't follow the wake word (just examples of an Alexa device incorrectly thinking it heard it).
To suggest that a serial root console is a point of attack for an Echo device is bordering on insanity. You'd need a breakout board connected via the USB interface (not port, mind you) in order for this work-around to be effective. So yes, if a hacker had physical access to your device, time enough to solder on a breakout board, said third-party could record a variety of things.
But then, it's a whole hell of a lot easier to just install a mic in someones house and get the same effect, now wouldn't it?