Backends that let developers create custom apps are also exposing Alexa and Google Home devices to eavesdropping and phishing attacks, security researchers discovered.

Details of the vulnerabilities were first disclosed in a blog post by the team at SRLabs. The findings suggest that the backends could let hackers take advantage of how smart devices take in and reply to commands.

By inserting a special character to induce silence from an app, for instance, cybercriminals could dupe users into thinking the device has failed, prompting them to hand over their Alexa or Google Home access credentials.

‘Please Tell Me Your Password’

By using the “U+DB01, dot, space” sequence — which also looks like a question mark inside a black diamond shape — an Alexa or Google Home device might pause unexpectedly. In a video where the researchers demonstrated an attack, however, a blue status light on an Alexa speaker shows it is still active. Bad actors could then dupe users into believing their device was running an update and asking for their passwords.

The same character sequence could be used to continue listening and record what users say, even after they’ve finished giving a command. Whatever was recorded during the eavesdropping session could then be sent to a third-party command and control (C&C) server.

Fears about phishing and eavesdropping attacks via Alexa and Google devices have been raised several times by other researchers over the past year. While vendors typically verify the security of custom apps when they first become part of a platform, the issue is whether the security is vetted again when they are updated later on.

Google and Amazon responded to the SRLabs report in emails to ZDNet, saying they had been made aware of the findings and would “put additional mechanisms in place to prevent these issues from occurring in the future.”

Professional and Personal Risks of Smart Devices

Even though they tend to be considered personal technologies, Alexa and Google Home products can wind up extending the boundaries of work. Experts suggest this may require thinking about how to ensure enterprise mobility management (EMM) tools mitigate the risks from emerging device categories.

For everyday people, meanwhile, using smart speakers and related internet of things (IoT) devices is still a relatively recent phenomenon and may require a little self-training to learn common security risks. Just as banks won’t ask for account credentials via an email or text message, for example, vendors won’t ask for usernames and passwords through their device. If your device is asking for that kind of personal data, talk to an expert for help.

More from

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers.A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords for…

The Role of Finance Departments in Cybersecurity

Consumers are becoming more aware of the data companies collect about them, and place high importance on data security and privacy. Though consumers aren’t aware of every data breach, they are justifiably concerned about what happens to the data companies collect. A recent study of consumer views on data privacy and security revealed consumers are more careful about sharing data. The majority of respondents (87%) say they wouldn’t do business with companies that appear to have weak security. Study participants also…

The One Place IT Budget Cuts Can’t Touch: Cybersecurity

If IT spending is slowing, will business leaders follow a similar approach for cybersecurity budgets? Probably not. Gartner predicts that end-user spending on both security technology and services will see an annual growth rate of 11% over the next four years. And the market is anticipated to reach $267.3 billion in 2026. Many security professionals agree that security spending cuts aren’t likely. Given the current threat landscape, strong security has quickly become a business imperative. Security has become the highest…