A vulnerability in the Amazon Echo device can be exploited to turn it into a covert spying tool, according to researchers at MWR InfoSecurity.
The popular speaker-come-personal-assistant is vulnerable to a physical attack that enables a threat actor to covertly monitor and listen in on users, stealing private data, without any indication of anything untoward.
While earlier research had shown that it was possible to boot into a generic Linux environment from an external SD card, via the debug pads exposed when the Echo rubber base is removed, MWR researchers managed to boot into the Echo firmware itself.
This enabled them to install a 'persistent implant' and gain remote root shell access, before remotely monitoring the always listening microphone of the Echo. MWR's researchers developed scripts to leverage tools embedded on the device in order to stream the resulting audio to a remote server.
The vulnerability has been confirmed to affect the 2015 and 2016 editions of the device. Neither the 2017 model, or the Amazon Dot, is vulnerable.
Amazon has responded to the revelation by stating: "Customer trust is very important to us. To help ensure the latest safeguards are in place, as a general rule, we recommend customers purchase Amazon devices from Amazon or a trusted retailer and that they keep their software up-to-date."
Given the need for physical access to the device, and the 'non-trivial' route to exploiting the vulnerability, how much of a real-world risk is this though? SC spoke to Mark Barnes, security consultant at MWR Infosecurity, who said "One of the most prominent sources for potential attacks would be second-hand units. Any device bought from an unofficial, untrusted source could potentially be compromised, and indeed criminals could even deliberately buy and sell on compromised units to reach victims."
Although Barnes admitted that performing an exploit from scratch would take several hours and need a high level of skill, he also told us that "it's possible to create a small device that could be quickly plugged into the unit to inject the malware and necessary code." That would make the Amazon Echo exploitable within a matter of minutes, and by anyone with access to the device."
Of course, the need to physically access the unit means that compromising a device would generally be a specific, targeted attack. "Any publicly accessible Echo would be at risk however" Barnes insisted "we have seen cases of hotels and conference rooms that provide an Echo for use by their guests."
So what mitigation advice is there for owners of the 2015 and 2016 Echo models which remain vulnerable?
"Anyone concerned they may have been compromised can use the physical mute button on top of the device" Barnes explains "and this will prevent the device from ambiently listening." Although there are no physical or operational signs anything is wrong, it is also possible to detect the compromise by monitoring network traffic for abnormal activity.
To mitigate the risk of future compromise, users should buy the new 2017 model if possible, as these do not contain the flaw. "Older models should only be purchased from legitimate sources rather than unofficial sellers" Barnes warns, concluding "users can check the packaging to ensure it hasn't been intercepted and tampered with."
