Alexa is a snitch collects your audio indefinitely
•Download as PPTX, PDF•
0 likes•125 views
This is a presentation on the state of data security in voice assistants. While this focuses on the current market leader, Amazon's Alexa, the material in this presentation can be more broadly applied. All opinions are my own.
Recommended
More Related Content
More from Wes Widner
Recently uploaded
Recently uploaded (20)
Alexa is a snitch collects your audio indefinitely
- 1. Alexa is a snitch! WesWidner – CrowdStrike
- 2. tl;dr Alexa collects your audio www.hackerhalted.com 2 • But you already knew that.. • What you may not know is what that audio contains • ..or how its stored • ..or who it’s shared with • ..or what to do about it!
- 3. Alexa is always listening www.hackerhalted.com 3 • The mute button is designed to be irritating • Alexa is almost the perfect listening device • Alexa is basically an excellent microphone with a computer attached • 2nd gen Alexa’s had a 7 mic array • Newest one comes with 4 far-field microphones • Easily triggered by design • The inverse square law means sound drops by 6db for every doubling of distance • So far-field mics must be extra-sensitive
- 6. Alexa is always recording www.hackerhalted.com 6 • Recordings are kept indefinitely • Recordings are kept in a large collection • Recordings are not protected by strong access controls
- 9. And when a customer interacts with an Alexa skill, that skill developer may also retain records of the interaction. www.hackerhalted.com 9
- 11. Kept in a large repository.. www.hackerhalted.com 11
- 13. Alexa doesn’t just record voice www.hackerhalted.com 13 • The audio landscape around us rarely has a single sound event going on • New apps and papers reveal that voice is not the only thing that's recorded • Environment, emotions and health are also recorded
- 19. www.hackerhalted.com 19 A treasure trove of fingerprints
- 24. www.hackerhalted.com 24 I’m sorry Dave…
- 26. Alexa is not the only snitch www.hackerhalted.com 26 • Google and Siri are also designed this way • Google plans to turn some phones into Alexa devices • Baidu and Sonos are catching up • Even without these, listening devices are pretty cheap
- 27. www.hackerhalted.com 27 Et tu, Google?
- 28. www.hackerhalted.com 28 A few bad Apples..
- 29. www.hackerhalted.com 29 Smart speakers everywhere!
- 30. Snitches get stitches www.hackerhalted.com 30 • You knew this was coming.. • Be mindful of the audio you produce • Consider shaping that landscape • Dampen or mask areas like you were a cold war spy • Help out with an open source on-prem voice assistant • Shut your mouth • Know and respect the actors trying to protect you
- 32. www.hackerhalted.com 32 If you’re not paying for it..
- 35. www.hackerhalted.com 35 But in all seriousness
- 38. Shout out to the Mozilla Voice project www.hackerhalted.com 38 https://voice.mozilla.or g
- 40. Conclusion www.hackerhalted.com 40 • Alexa is always listening • Amazon is always recording • Alexa doesn’t just record voices • Alexa isn’t the only snitch • Snitches get stitches
- 41. The end – Thanks for coming! Wes Widner Cloud Engineering Manager Crowdstrike (we’re hiring engineers) wes.widner@crowdstrike.com @kai5263499 https://github.com/kai5263499/audio-security-awesome www.hackerhalted.com 41
Editor's Notes
- https://www.forbes.com/sites/charlesradclyffe/2018/08/29/the-deliberate-design-flaw-in-every-amazon-echo/#640e5bc931b0
- https://www.forbes.com/sites/charlesradclyffe/2018/08/29/the-deliberate-design-flaw-in-every-amazon-echo/#640e5bc931b0
- https://threatpost.com/amazon-admits-alexa-voice-recordings-saved-indefinitely/146225/?fbclid=IwAR3YFpZBQ0fDw-HL5pXRxiMUA0c8BWMNNKEGzgfOS08pT6fbw7tw5R0xX2o
- Amazon’s letter to U.S. Senator Chris Coons (D-Del.) https://www.coons.senate.gov/imo/media/doc/Amazon%20Senator%20Coons__Response%20Letter__6.28.19%5b3%5d.pdf
- https://arstechnica.com/information-technology/2018/08/researchers-show-alexa-skill-squatting-could-hijack-voice-commands/
- https://threatpost.com/amazon-1700-alexa-voice-recordings/140201/
- https://www.forbes.com/sites/kateoflahertyuk/2019/04/12/amazon-staff-are-listening-to-alexa-conversations-heres-what-to-do/#4f57d8ef71a2
- https://www.seattletimes.com/business/amazon/suit-alleges-amazons-alexa-violates-laws-by-recording-childrens-voices-without-consent/
- https://developer.amazon.com/blogs/alexa/post/d6fe5fef-b546-430c-8dcc-5cd4fecd410b/audio-watermarking-algorithm-is-first-to-solve-second-screen-problem-in-real-time
- https://nypost.com/2017/07/10/alexa-calls-cops-on-man-allegedly-beating-his-girlfriend/
- https://www.newsweek.com/amazon-alexa-recordings-romania-sex-privacy-1452173
- https://techcrunch.com/2018/11/14/amazon-echo-recordings-judge-murder-case/
- https://pdfs.semanticscholar.org/a641/3620dcf0a21f10d22e01427121cc7c6dc8fa.pdf
- https://www.cnet.com/how-to/alexa-can-tell-you-if-someone-breaks-into-your-house/
- https://thenextweb.com/artificial-intelligence/2018/10/15/amazons-new-patent-will-allow-alexa-to-detect-your-illness/
- https://www.theverge.com/2019/4/4/18295260/amazon-hipaa-alexa-echo-patient-health-information-privacy-voice-assistant
- https://www.theregister.co.uk/2019/06/21/alexa_heart_attack/
- https://www.businessinsider.com/amazon-patent-alexa-emotional-intelligence-2018-10
- https://features.propublica.org/aggression-detector/the-unproven-invasive-surveillance-technology-schools-are-using-to-monitor-students/
- https://www.wsj.com/articles/google-contractors-listen-to-recordings-of-consumers-addressing-virtual-assistant-11562865883
- https://www.theverge.com/2019/7/26/8932064/apple-siri-private-conversation-recording-explanation-alexa-google-assistant
- https://www.bbc.com/news/technology-49343262
- https://www.engadget.com/2014/03/12/acoustic-invisibility-cloak/?guccounter=1&guce_referrer=aHR0cDovL3Rla2RlZi5jb20vYWNvdXN0aWMtY2xvYWstc2hpZWxkLXN1Ym1hcmluZXMtY29uZS1zaWxlbmNlLw&guce_referrer_sig=AQAAAC4swWpHRc3psg61j8qIKtDYJn5ygtTQLxuutIzFTFA0baK0TSCPTZknm1pA43nH7d21qIA01wpMCviKeTszk1BGNvZmKIYWxSPZ5H4jixRB1WcSYCzrYeVnTFT4FU0S9LLsrMCT3VDaVzvKKA2kn21YakyabzXv39PJQQbjTC1d https://www.youtube.com/watch?time_continue=9&v=k13L8u2tACY
- https://www.cnet.com/news/helmfon-noise-isolating-helmet-hochu-rayu-work/
- https://www.instructables.com/id/Project-Alias/
- https://cambridgesound.com/wp-content/uploads/2015/10/Speech-Privacy-Standards.pdf
- https://voice.mozilla.org/en
- https://github.com/mozilla/DeepSpeech