Cybercrime Security Forum - Europe 2018 Session

1. For your Ears Only
Voice Recognition Security Secrets
Unleashed!
Andy Malone MVP
Founder: Cybercrime Security Forum

2. Microsoft MVP (Enterprise
Security)
Microsoft Certified Trainer (20
years)
Founder: Cybercrime Security
Forum
Worldwide Event Speaker
Author: The Seventh Day
Andy Malone
(United Kingdom)
Follow me on Twitter
@AndyMalone

3. Session Outline
• What is Voice Recognition
• How Voice Recognition Works
• Where Voice Recognition is Used
• The Rise of the Intelligent
Personal Assistant
• Amazon Alexa Architecture
Walkthrough
• Voice Recognition &
Cybersecurity
• Where does my Data Go?
• Voice Recognition & Digital
Forensics
• The Future …

4. What is Voice
Recognition?

5. Voice or speech recognition is the ability of
a machine or program to receive and interpret
dictation, or to understand and carry out
spoken commands

6. What is Voice Recognition?
• Uses a Natural user
interface: human speech
• Provides a Convenient &
Preferred Biometric
Method for Consumers
• Many applications,
including the Provision
of Improved services for
the disabled
• Technology easily
Customizable, i.e.
Language etc.
• Used for both
Identification,
Authentication &

7. How Voice Recognition
Works

8. How Animals Communicate!

9. How Humans Communicate
2 phonemes
1 Phones
3 Cognitive learning /
Experience & Language
Processing
Articulation produces sound waves which the ear conveys to the brain
for processing

10. How Computers Recognise Speech
Digitization Acoustic analysis of the speech signal Linguistic
interpretation

11. Potential Problems with VR?
• Problem Separating
Acoustic signal from
background noise. I.e.
Single voice in a Noisy
Room
• Voice Speed, Tone,
Dialect, Language
• Misheard or Misunderstood
• Privacy Issues: Using a
keyword to initiate
session. I.e. ”Alexa” or
“Hey Siri”
• Liveness Detection: Can

12. Where Voice
Recognition
is Used

13. Where & How is Voice Recognition is Used
Voice Recognition
Text to Speech Basic Dictation Call Answering Systems
Interactive Personal Assistant Identity & Authentication
IoT Devices Robotics Artificial Intelligence
The Apple Vision

14. Human Biometrics: Everything has a Pattern

15. Speech Recognition vs Speaker Verification
The most important
difference is that:
• Speech recognition
identifies what you
are saying
• Speaker verification
verifies that you are
who you say you are

16. Voice Biometrics
• Speech recognition and speaker
verification systems are
combined to create voice
biometric systems
• Used to both Identify &
Authenticate Users
• Uses a measurable, physical
characteristic, or personal
behavioural trait to verify and
authenticate an individual
• It uses what you are as a way
to identify yourself
• Compares at least two two

17. Voice Biometric Acquisition Process

18. How it Works
• Biometric systems must be able
to distinguish between various
people’s voices
• Frequency and Intensity
• Training our body’s nasal and
oral passages, as well as our
lips, teeth, tongue, and jaw
muscles
• Digitizing a person's speech
to produce a “voice print”
• Voices are nearly impossible
to recreate

19. The Rise of
the
Intelligent
Digital
Assistant

20. Video
30 years Ago! March
1987

22. In a Nutshell - Apple: The Grand Vision
• Touch screens and cinematic animation
• Global network for info and collaboration
• Awareness of temporal and social context
• Continuous Speech in and out
• Conversational Interface - assistant talks
back
• Delegation of tasks to the assistant
• Assistant use of personal data

23. And the Reality … • Touch screens
• Cinematic effects
• Global network
• Location and time
awareness
• Speech out, on demand
• Isolated speech to text
• Limited Siri Assistant

24. The Evolution of Siri Personal Assistant
• Started at SRI (previously
Stanford Research Institute)
• Roots in the CALO (Cognitive
Assistant that Learns and
Organize) project in the early
2000s
• Siri project started in 2007 ,
Spun off from SRI as a company
in 2008
• App on iPhone then acquired by
Apple in 2010
• Nuance (speech recognition) Spun
off from SRI as a company in
1994

25. The Rise of the Intelligent Connected Devices
Voice Controlled Cars
Voice Controlled Door Lock
Voice Controlled Banking
Smart TV

26. The Rise of the Intelligent Personal Assistants
Apple Siri
Microsoft Cortana
Google Home
Amazon Dot / Echo (Alexa)

27. Combining Voice Recognition & Artificial Intelligence
• Voice Recognition
• Machine Learning
• Artificial Intelligence (AI)
• NLP (Neuro-Linguistic
Programming)
• Cloud Computing
• IoT
• Started life as a PDA
(Personal Data Assistant)
Device
• Now evolving into an
Ubiquitous Personal

28. Alexa Artificial Intelligence
• Hands-free, voice-controlled device that
uses Alexa to play music, control smart
home devices, provide information, read
the news, set alarms, and more.
• Play music Various Sources inc Amazon
Music, Spotify, Controls lights, fans,
switches, thermostats, garage doors,
sprinklers, and more
• Hears you from across the room with 7
far-field microphones for hands-free
control, even in noisy environments or
while playing music
• An assistant in the kitchen or anywhere
you might want a voice-controlled
computer

29. Alexa
Architecture &
Configuration

30. 1: Register to link account to device / service
2 Authorise Alexa to use the resource.
3 Users Must Authenticate
4 authorised to access resources will get the confirmation screen
5 Congratulations, it’s done.

32. DemoMeeting & Securing
Alexa

33. Voice
Recognition &
Cybersecurity

34. Personal Assistant Privacy Issues
• Voice Assistants are constantly listening to
everyone within microphone range for input by
default
• Uses 3 Keywords: Alexa, Amazon & Computer
(Configurable)
• Microphones are always listening unless physically
muted
• Voice assistants cannot differentiate between
different people
• Devices upload recordings and store them on cloud
servers
• Data collected from recordings are used to provide
a customized experience and, AKA advertising

35. Personal Assistants Privacy Tips
• Physically mute the Echo when not in use
• Delete old recordings your Amazon account
dashboard under "Manage my device”
• Users can delete individual queries or wipe their
entire search history all at once
• Refrain from connecting important accounts to your
Echo
• In Alexa's configuration, set up an "end of
request" tone that will make a sound to let you
know the Echo has stopped listening
• Stay alert of the LED lights that change color
when Alexa is listening

36. Voice Recognition: The Privacy Dilemma
• All Voice recognition technologies pierce the "veil
of anonymity"
• Where are voice patterns Stored? “function creep”
• What is the Cloud Vendor Biometric Security Policy?
• Big difference between storing something you have or
know with Something you are!
• How are these patterns Secured?
• Who has Access to them?
• How is your Privacy Maintained?
• What Metadata is Produce?
• What if your Voice Pattern could be duplicated?

37. Weeping Angel: Samsung Hack:
• Key Features:
• Turns on in Fake-Off mode
• Collect unencrypted audio
collection
• Collects Streaming audio
• Video capture / Video
snapshots
• Samsung offers remote support
– An area of functionality to
investigate?
• Is the browser or any default
apps vulnerability to MitM
attacks? https://www.wikileaks.org/ciav7p1/cms/page_12353643.html

38. NSA: If you can say it, you can search it.
• The NSA begins using speech
recognition to isolate keywords
when analysing recorded
conversations
• Searchable using X-Keyscore
• PRISIM: Designed to analyze and
“extract” the content of voice
conversations, and even use
sophisticated algorithms to flag
conversations of interest
• How long will it be before laws
allow the police to activate a
smart assistant and listen in on

39. Where does my data go?
AlexaUser
User
User
Alexa
Alexa
Router Amazon Cloud
Law Enforcement

40. Digital Assistants & The Law
• Landmark Case Feb 2017
• James Andrew Bates
• Amazon resists efforts in a US
murder case to obtain recordings
from one of its Echo smart
speakers
• First formal legal response,
Amazon said prosecutors had
failed to establish it was
necessary
• ”Always on" Echo records audio
if it hears from a fraction of a
second before it detects a wake
word - either Alexa or Amazon -

41. Video
Using Alexa as a Witness!

43. Digital Assistants & The Law

44. Operation BugDrop Malware
• State Sponsored by Russia
• Infiltrates victim's computer,
captures screen shots, documents,
and passwords, and turn on
microphone to capture all audio
• Targets include: Ukraine, Russia,
Saudi Arabia, Austria
• Sophisticated malware backed by an
organization with substantial
resources,”
• Operation requires a massive back-
end infrastructure to store,
decrypt, and analyse several GBs
per day of unstructured data that
is being captured from its targets

45. Gaining Backdoor to an Amazon Account

46. Gaining Backdoor to an Amazon Account
1: User buys Malicious Product or
downloads malicious code from website
2: Webpage or even Product is infected
3: Credentials Stolen
4: Gains Access to account via stolen
Credentials5: Access to voice logs

47. Voice
Recognition &
Digital
Forensics

48. Digital Forensics?
“Digital Forensics is the application
of science to the identification,
examination, collection, and analysis
of data while preserving the
information and maintaining a strict
chain of custody for the data.”

49. Forensic Essentials
Identify
Evidence
Collect
or
Acquire
Evidence
Examine
or
Analyze
Evidence
Present
Findings

50. Alexa: Tell me your Secrets!
HTTPS / SSDP HTTPS / SSDP HTTPS / SSDP
Log File Wi-Fi Log File
Amazon Cloud
Simple Service Discovery Protocol (SSDP)

51. DemoRouter WiFi Log

53. DemoAlexa Network Analysis
(Wireshark)

54. Alexa: Tell me your Secrets!
• Take a Backup of ITunes
• Locate the com.amazon.echo directory
• Files include: references plist, binary cookies, and
‘LocalData.sqlite’. The SQLite
• Locate SQLite DBs (SQLite viewer)
• Displayed 4 tables: ZDATAITEM, Z_METADATA, Z_MODELCACHE, and
Z_PRIMARYKEY

55. Alexa: Tell me your Secrets!
• Review the ZDATAITEM table
• Out of the 4 Rows 2 were of interest.
• Key/value pairs, with ZKEY being ToDoCollection.TASK or
ToDoCollection.SHOPPING_ITEM, and ZVALUE being a long JSON
string

56. Alexa: Tell me your Secrets!
• Now we know the DOT has created two todo-type lists
• Now we can parse this by matching up the 2 rows in the
ZDATAITEM table. Each ZVALUE is an array of JSON objects, with
each object containing information about a specific task

57. Alexa: Tell me your Secrets!
• Item Text
• Date / Timestamp
• Unique Item ID: CustomerId:
A1C9VTA5F7ZW1N
• itemId: A1C9VTA5F7ZW1N#6826a04d-b48e-
3128-a1cc-9037bd48ee6d
• utteranceId: nulloriginalAudioId:
AB72C63C86AW3:1.0/2016/03/05/23/B0F00
615549601C4/03:40::TNIH_2V.14c747fb-
52c0-4018-8908-4163f73cb865ZXV/0
• Status Item
• complete: true
• deleted: false
• type: SHOPPING_ITEM
• version: 2

58. DemoHow Forensics Tools Adapting

59. DemoGoogle Voice Assistant

61. Video
Introducing Adobe
VOCO!

63. And so it begins …

64. Personal Digital Assistant Conclusions
• Consider using Multi factor
Authentication (Esp with IoT devices)
• Ensure Systems are muted when having
private conversations
• IoT is awesome, however consider
against using digital Locks and other
sensitive devices.
• Most devices / Technologies Cannot
differentiate between users, this
could be a problem

65. Session Review
• What is Voice Recognition
• How Voice Recognition Works
• Where Voice Recognition is Used
• The Rise of the Intelligent
Personal Assistant
• Amazon Alexa Architecture
Walkthrough
• Voice Recognition &
Cybersecurity
• Where does my Data Go?
• Voice Recognition & Digital
Forensics
• The Future …

66. Just before I go, Here’s one final
thought …