The Insecurity of Home Digital Voice Assistants - Amazon Alexa as a Case Study
By Xinyu Lei, Guan-Hua Tu, Alex X. Liu, Chi-Yu Li, Tian Xie. 2017
88 citations recorded by the source corpus.
Home Digital Voice Assistants (HDVAs) are getting popular in recent years. Users can control smart devices and get living assistance through those HDVAs (e.g., Amazon Alexa, Google Home) using voice. In this work, we study the insecurity of HDVA service by using Amazon Alexa as a case study. We disclose three security vulnerabilities which root in the insecure access control of Alexa services. We then exploit them to devise two proof-of-concept attacks, home burglary and fake order, where the adversary can remotely command the victim's Alexa device to open a door or place an order from Amazon.com. The insecure access control is that the Alexa device not only relies on a single-factor authentication but also takes voice commands even if no people are around. We thus argue that HDVAs should have another authentication factor, a physical presence based access control; that is, they can accept voice commands only when any person is detected nearby. To this end, we devise a Virtual Security Button (VSButton), which leverages the WiFi technology to detect indoor human motions. Once any indoor human motion is detected, the Alexa device is enabled to accept voice commands. Our evaluation results show that it can effectively differentiate indoor motions from the cases of no motion and outdoor motions in both the laboratory and real world settings.
Subfields: Artificial Intelligence, Information Systems
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
In Information Systems
Citations in the corpus
- Privacy-Preserving Adversarial Representation Learning in ASR: Reality or Illusion? (2019, neutral): “While recent studies have identified security vulnerabilities in these devices [3,4], such studies tend to hide more important privacy risks that can have long-term impact.”
- Alexa, she's not human but… Unveiling the drivers of consumers' trust in voice‐based artificial intelligence (2021, background): “…may include a young child asking their mother for a particular toy for their birthday and asks her to order it on Amazon; the Alexa on their mothers' home device or smartphone may over ‐ hear this and assume this order is intended to be placed, and then does so (Hackett, 2017; Lei et al., 2017).”