Attacks and Defense on Voice controlled device. some of the slides, Figures and Information are collected from the following paper- https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-kumar.pdf

1. Security of
Voice Controlled Device

2. Outline
● Introduction to VCD (Voice Controlled Device)
● Background Information
● Attack on Voice Controlled Device (Skill Squatting Attacks on
Amazon Alexa)
● Defense against State-of-the-attacks ( EchoSafe )

3. Voice Controlled Device (VCD)
● Voice Interaction
● Providing Real time information
● Play Music
● Communicate with other smart devices

4. Interaction with VCD (Alexa)
Taken from: https://techfactslive.com/amazons-alexa-adds-voice-commands-oscars-awards-2018/42686/

5. Attack

6. Real Time Attack
Taken from: A guide to the security of voice-activated smart speakers by Symantec

7. Real Time Attack
Taken from: A guide to the security of voice-activated smart speakers by Symantec

8. Demo Attack
CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition

9. Real Time Attack

10. Real Time Attack
Taken from: A guide to the security of voice-activated smart speakers by Symantec

11. Attack on VCD

12. Brainstorm
How to design further attacks???

13. Brainstorm
How to design further attacks???
● Alexa makes mistakes
● Skills are the new apps

14. Brainstorm
How to design further attacks???
● Alexa makes mistakes
● Skills are the new apps
What could go wrong???

15. Skill Squatting Attacks on
Amazon Alexa
Authors- Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua
Mason, Adam Bates, and Michael Bailey, University of Illinois, Urbana-Champaign

16. Skill
● Similar to mobile app
● Third party application that leverage alexa voice services
● Interacts with human voice
● Currently, 30000 skills are active in amazon website

17. Attack Strategy

18. Attack Strategy

19. Attack Strategy

20. Attack Strategy

21. Attack Strategy
An attacker can leverage predictable errors in Alexa to route users
to skills that they didn't intend to go to

22. Attack Strategy
How can you tell which errors are predictable???

23. Attack Strategy
How can you tell which errors are predictable???
Send speech samples to Alexa, figure out
where it goes wrong

24. Speech Corpus

25. Predictable Errors

26. Predictable Errors

27. Validating the Skill Squatting Attack
Split speakers into two sets: “training” set and the “testing” set
For each word with predictable error, we built two skills: the word, and the predictable error
Skill A: Wet
Skill B: What
Sent the testing set through to Alexa, observed how many times skill B was triggered instead of skill A

28. Validating the Skill Squatting Attack
Split speakers into two sets: “training” set and the “testing” set
For each word with predictable error, we built two skills: the word, and the predictable error
Skill A: Wet
Skill B: What
Sent the testing set through to Alexa, observed how many times skill B was triggered instead of skill A
Successfully squatted 25 of 27 (93%)
predictable errors at least once

29. Validation
I would never want a cat or fish fact
Why does this matter???

30. Security Threat

31. Security Threat (Benign)

32. Security Threat (Benign)

33. Security Threat (Benign)

34. Security Threat (Benign)

35. Security Threat (Malicious)

36. Security Threat (Malicious)

37. Security Threat (Malicious)

38. Security Threat (Malicious)

39. Takeaways
● New medium, same problems
○ “Typosquatting” in the land of IoT
● Opaque ML for decision making is still nascent
○ Interface quirks can and will be exploited to cause abuse

40. Defense

41. Echosafe: Sonar-based
Verifiable Interaction with
Intelligent Digital Agents
Authors: Amr Alanwar, Bharathan Balaji, Yuan Tian, Naveen Iyer, Shuo Yang, Mani
Srivastava

42. Threat Model
● Defend against remote attacks
● Attacks can be thwarted when user is present
● Trust the device vendor

43. Experimental Setup
● Simple Speaker
○ Omnidirectional
● Matrix Creator Microphone Array
○ 8 Microphones
○ Beamforming
○ 16 KHz sampling rate
○ Works with Raspberry pi
● Audio features from time windows
○ Mel-Frequency Cepstrum Coefficient (MFCC)
○ Mean, max, quantile, skew, kurtosis, standard deviation

44. Evaluation

45. Some Other Interesting Defenses
1. Hearing Your Voice is Not Enough: An Articulatory Gesture
Based Liveness Detection for Voice Authentication
2. Hello, Is It Me You’re Looking For? Differentiating Between
Human and Electronic Speakers for Voice Interface Security
3. ...

46. Thanks :D

47. Backup

48. Attack Strategy

49. Attack Strategy

50. Attack Strategy

51. Commander song demo : https://www.youtube.com/watch?v=kTPkwDzybcc
Hidden Voice Attack : http://www.hiddenvoicecommands.com/demo