How voice assistants can be used to phish passwords

Written by: RedGoat

Categorized: Blog

We have seen a wealth of articles on the security and privacy issues around voice assistants. This week I came across and new and far more concerning article on this by Ars Technica: “Amazon- and Google-approved apps turned both voice-controlled devices into “smart spies”.

“By now, the privacy threats posed by Amazon Alexa and Google Home are common knowledge. Workers for both companies routinely listen to audio of users—recordings of which can be kept forever—and the sounds the devices capture can be used in criminal trials.

Now, there’s a new concern: malicious apps developed by third parties and hosted by Amazon or Google. The threat isn’t just theoretical. Whitehat hackers at Germany’s Security Research Labs developed eight apps—four Alexa “skills” and four Google Home “actions”—that all passed Amazon or Google security-vetting processes. The skills or actions posed as simple apps for checking horoscopes, with the exception of one, which masqueraded as a random-number generator. Behind the scenes, these “smart spies,” as the researchers call them, surreptitiously eavesdropped on users and phished for their passwords”.

Behind the scenes they phished for their users’ passwords

We all knew that there were some big questions concerning the privacy implications of voice assistants. A common phrase I would come across was “I don’t mind Google or Amazon having my data”. Perhaps that is how you feel but when attackers can now abuse these voice assistants and compromise your privacy things become much more concerning.

“The malicious apps had different names and slightly different ways of working, but they all followed similar flows”.

When a user would ask for their Horoscope the eavesdropping apps gave a response and then fell silent whilst secretly logging the conversations that were in earshot of the device. The phishing apps worked in a similar way but they responded with “an error message that claims the skill or action isn’t available in that user’s country. They then go silent to give the impression the app is no longer running. After about a minute, the apps use a voice that mimics the ones used by Alexa and Google home to falsely claim a device update is available and prompts the user for a password for it to be installed”.

A really great article by Ars Technica. Read the full article and watch the videos here: https://arstechnica.com/information-technology/2019/10/alexa-and-google-home-abused-to-eavesdrop-and-phish-passwords/

Related Content

How to get exec approval for a cyber exercise

Testing your response to a cyber-attack will save you resources in the event of a real incident, but for many organisations taking the first step in exercising can seem like a big commitment in time and energy. Here are some top tips on getting exec approval for a cyber exercise.

Read more

Get started with crisis communication planning

Cyber-attacks are no longer outlier events. In fact, the old saying of “it’s not if – but when” has sadly proven true for many organisations. For this reason many organisations are now heavily focused on planning and preparing for a cyber-attack and increasing their levels of resilience, response and redundancy to enable them to survive.

Read more
Menu