October 22, 2019 By Shane Schick 2 min read

Backends that let developers create custom apps are also exposing Alexa and Google Home devices to eavesdropping and phishing attacks, security researchers discovered.

Details of the vulnerabilities were first disclosed in a blog post by the team at SRLabs. The findings suggest that the backends could let hackers take advantage of how smart devices take in and reply to commands.

By inserting a special character to induce silence from an app, for instance, cybercriminals could dupe users into thinking the device has failed, prompting them to hand over their Alexa or Google Home access credentials.

‘Please Tell Me Your Password’

By using the “U+DB01, dot, space” sequence — which also looks like a question mark inside a black diamond shape — an Alexa or Google Home device might pause unexpectedly. In a video where the researchers demonstrated an attack, however, a blue status light on an Alexa speaker shows it is still active. Bad actors could then dupe users into believing their device was running an update and asking for their passwords.

The same character sequence could be used to continue listening and record what users say, even after they’ve finished giving a command. Whatever was recorded during the eavesdropping session could then be sent to a third-party command and control (C&C) server.

Fears about phishing and eavesdropping attacks via Alexa and Google devices have been raised several times by other researchers over the past year. While vendors typically verify the security of custom apps when they first become part of a platform, the issue is whether the security is vetted again when they are updated later on.

Google and Amazon responded to the SRLabs report in emails to ZDNet, saying they had been made aware of the findings and would “put additional mechanisms in place to prevent these issues from occurring in the future.”

Professional and Personal Risks of Smart Devices

Even though they tend to be considered personal technologies, Alexa and Google Home products can wind up extending the boundaries of work. Experts suggest this may require thinking about how to ensure enterprise mobility management (EMM) tools mitigate the risks from emerging device categories.

For everyday people, meanwhile, using smart speakers and related internet of things (IoT) devices is still a relatively recent phenomenon and may require a little self-training to learn common security risks. Just as banks won’t ask for account credentials via an email or text message, for example, vendors won’t ask for usernames and passwords through their device. If your device is asking for that kind of personal data, talk to an expert for help.

More from

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Research finds 56% increase in active ransomware groups

4 min read - Any good news is welcomed when evaluating cyber crime trends year-over-year. Over the last two years, IBM’s Threat Index Reports have provided some minor reprieve in this area by showing a gradual decline in the prevalence of ransomware attacks — now accounting for only 17% of all cybersecurity incidents compared to 21% in 2021. Unfortunately, it’s too early to know if this trendline will continue. A recent report released by Searchlight Cyber shows that there has been a 56% increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today