Backends that let developers create custom apps are also exposing Alexa and Google Home devices to eavesdropping and phishing attacks, security researchers discovered.

Details of the vulnerabilities were first disclosed in a blog post by the team at SRLabs. The findings suggest that the backends could let hackers take advantage of how smart devices take in and reply to commands.

By inserting a special character to induce silence from an app, for instance, cybercriminals could dupe users into thinking the device has failed, prompting them to hand over their Alexa or Google Home access credentials.

‘Please Tell Me Your Password’

By using the “U+DB01, dot, space” sequence — which also looks like a question mark inside a black diamond shape — an Alexa or Google Home device might pause unexpectedly. In a video where the researchers demonstrated an attack, however, a blue status light on an Alexa speaker shows it is still active. Bad actors could then dupe users into believing their device was running an update and asking for their passwords.

The same character sequence could be used to continue listening and record what users say, even after they’ve finished giving a command. Whatever was recorded during the eavesdropping session could then be sent to a third-party command and control (C&C) server.

Fears about phishing and eavesdropping attacks via Alexa and Google devices have been raised several times by other researchers over the past year. While vendors typically verify the security of custom apps when they first become part of a platform, the issue is whether the security is vetted again when they are updated later on.

Google and Amazon responded to the SRLabs report in emails to ZDNet, saying they had been made aware of the findings and would “put additional mechanisms in place to prevent these issues from occurring in the future.”

Professional and Personal Risks of Smart Devices

Even though they tend to be considered personal technologies, Alexa and Google Home products can wind up extending the boundaries of work. Experts suggest this may require thinking about how to ensure enterprise mobility management (EMM) tools mitigate the risks from emerging device categories.

For everyday people, meanwhile, using smart speakers and related internet of things (IoT) devices is still a relatively recent phenomenon and may require a little self-training to learn common security risks. Just as banks won’t ask for account credentials via an email or text message, for example, vendors won’t ask for usernames and passwords through their device. If your device is asking for that kind of personal data, talk to an expert for help.