October 22, 2019 By Shane Schick 2 min read

Backends that let developers create custom apps are also exposing Alexa and Google Home devices to eavesdropping and phishing attacks, security researchers discovered.

Details of the vulnerabilities were first disclosed in a blog post by the team at SRLabs. The findings suggest that the backends could let hackers take advantage of how smart devices take in and reply to commands.

By inserting a special character to induce silence from an app, for instance, cybercriminals could dupe users into thinking the device has failed, prompting them to hand over their Alexa or Google Home access credentials.

‘Please Tell Me Your Password’

By using the “U+DB01, dot, space” sequence — which also looks like a question mark inside a black diamond shape — an Alexa or Google Home device might pause unexpectedly. In a video where the researchers demonstrated an attack, however, a blue status light on an Alexa speaker shows it is still active. Bad actors could then dupe users into believing their device was running an update and asking for their passwords.

The same character sequence could be used to continue listening and record what users say, even after they’ve finished giving a command. Whatever was recorded during the eavesdropping session could then be sent to a third-party command and control (C&C) server.

Fears about phishing and eavesdropping attacks via Alexa and Google devices have been raised several times by other researchers over the past year. While vendors typically verify the security of custom apps when they first become part of a platform, the issue is whether the security is vetted again when they are updated later on.

Google and Amazon responded to the SRLabs report in emails to ZDNet, saying they had been made aware of the findings and would “put additional mechanisms in place to prevent these issues from occurring in the future.”

Professional and Personal Risks of Smart Devices

Even though they tend to be considered personal technologies, Alexa and Google Home products can wind up extending the boundaries of work. Experts suggest this may require thinking about how to ensure enterprise mobility management (EMM) tools mitigate the risks from emerging device categories.

For everyday people, meanwhile, using smart speakers and related internet of things (IoT) devices is still a relatively recent phenomenon and may require a little self-training to learn common security risks. Just as banks won’t ask for account credentials via an email or text message, for example, vendors won’t ask for usernames and passwords through their device. If your device is asking for that kind of personal data, talk to an expert for help.

More from

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Cybersecurity Awareness Month: 5 new AI skills cyber pros need

4 min read - The rapid integration of artificial intelligence (AI) across industries, including cybersecurity, has sparked a sense of urgency among professionals. As organizations increasingly adopt AI tools to bolster security defenses, cyber professionals now face a pivotal question: What new skills do I need to stay relevant?October is Cybersecurity Awareness Month, which makes it the perfect time to address this pressing issue. With AI transforming threat detection, prevention and response, what better moment to explore the essential skills professionals might require?Whether you're…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today