Name: Alexa hack granted attackers access to an Echo user's smart home network | AppleInsider
Brand: appleinsider.com
SKU: appleinsider-com-39
Availability: OnlineOnly

critic

Alexa hack granted attackers access to an Echo user's smart home network | AppleInsider

preview

&nbsp;&nbsp;&nbsp;AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.A number of vulnerabilities have been revealed in Amazon's Alexa, highlighting the need for providers of smart home platforms, such as Apple's , to maintain security as part of the service. The concept of a smart home is attractive, but the dream of ordering a virtual assistant around to automate household tasks becomes a nightmare once security issues surface. In the case of Amazon's Alexa, which is at the heart of many people's smart home setup, vulnerabilities have been revealed that could have allowed an attacker to perform tasks and to find out what a user has told Alexa, issues that have since been fixed. The from Check Point Security researchers reveals a number of Amazon and Alexa subdomains were vulnerable to a Cross-Origin Resource Sharing (CORS) misconfiguration and Cross Site Scripting (XSS). By using XSS, an attacker would be able to acquire a CSRF token that would provide them access to elements of the smart home installation. According to the researchers, these could include automatically installing Alexa skills without the knowledge of the user, acquiring a list of all installed skills, silently removing installed skills, acquiring the victim's voice history with Alexa, and to even gain personal information. This skill manipulation could have allowed for a modified version of an existing skill to be installed and then used by the user, one that could allow actions to be performed by the attacker, or for further acquisition of data from the user. It could even have been possible for an attacker to install a skill to eavesdrop into conversations near an . While eavesdropping would have been possible, users had the potential tip-off of something untoward as listening would have triggered the blue light indicator on the Echo device. Users are normally able to monitor and delete their voice history via the page, or the Alexa app. Users can also wipe records by saying "Alexa, delete what I just said" or "Alexa, delete everything I said today," while an automated deletion option can wipe the data once it is three months or 18 months old. It is claimed a successful exploitation of the vulnerabilities would have been possible through a single Amazon link click by the victim. Check Point responsibly disclosed the vulnerabilities to Amazon in June 2020, and the issues have been fixed. "Internet of Things devices are inherently vulnerable and still lack adequate security, which makes them attractive targets to threat actors," Check Point writes. "Cybercriminals are continually looking for new ways to breach devices, or use them to infect other critical systems. This research presented a weak point in what is a bridge to such IoT appliances. Both the bridge and the devices serve as entry points. They must be kept secured at all times to keep hackers from infiltrating our smart homes." "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," said an Amazon spokesperson. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed." Amazon has courted controversy with the security and privacy issues of its smart home platform in the past. In 2019, it was found Amazon employees were listening to from Echo devices to improve its accuracy, while later in the same year researchers were able to add to app stores for Alexa and Google Home that enabled eavesdropping and phishing to take place. While Apple does operate its own HomeKit smart home platform, the company does work to keep each element as secure as feasibly possible. This includes extensive use of encryption, as well as a long list of requirements and restrictions each new HomeKit-compatible device must abide by to function on the platform. Update: August 18: Updated with Amazon statement and minor changes.Thats why I will never had one of these things in my house. &nbsp;They will have to get a lot more useful and secure before that happens (and it will have to be an Apple device.I saw this coming a mile away. &nbsp;Amazon and Google don’t make security a first priority for these kind of devices. &nbsp;It’s why I won’t use anything other than HomeKit.I clearly remember lots of vendors complaining about the security restrictions of HomeKit. &nbsp;Well... here’s why.No surprise here.&nbsp;Unless it connects directly to and only to HomeKit it won't be in my house.Almost all of these devices, the vast majority, require a third party hub.&nbsp;&nbsp; That automatically eliminates it from list of acceptable devices.Completely agree with all of the comments above. I avoid amazon like the plague and will never let them put an eves dropping device in my house.&nbsp;Please enable JavaScript to comment&nbsp;An app called Diffusion Bee lets users run the Stable Diffusion machine learning model locally on their Apple Silicon Mac to create AI-generated art. Here's how to get started.Apple announced iCloud Shared Photo Library as part of iOS 16, but it appears that the feature won't arrive in the iOS 16 release on September 12.An SEC filing from Globalstar reveals that Apple plans to use 85% of its current and future network capacity for its services to iPhone 14 consumers, and pay for future satellite upgrades.Apple's iPhone 14 Pro and iPhone 14 Pro Max have arrived. Here's how they stack up versus the iPhone 13 Pro and Pro Max.Apple's iPhone 14 is aimed at about the same market that the iPhone SE targets. Here's how it compares to the third-generation iPhone SE.Apple reintroduced the Plus iPhone descriptor at its event on Wednesday with the introduction of the iPhone 14 Plus. Here's how it compares to the iPhone 14 Pro Max.Apple has launched its iPhone 14 range, but on the surface it's a tough compare to the iPhone 13. Here's what's different and if it's good enough for an upgrade.The Apple Watch Series 8 and Apple Watch Ultra are the company's newest wearable accessories, and these are the features that might tempt new buyers or Apple Watch Series 7 owners.&nbsp;Apple has shared a new video that explains how its new Crash Detection feature can detect serious car crashes and alert emergency responders automatically.An app called Diffusion Bee lets users run the Stable Diffusion machine learning model locally on their Apple Silicon Mac to create AI-generated art. Here's how to get started.Safari 16.0 has been released for Apple's ecosystem, with the latest version of the browser for iOS 16 now able to open AVIF images ahead of similar support in macOS Ventura and iPadOS.For 72 hours only, save $150 on Apple's upgraded MacBook Air M2 at Apple Authorized Reseller B&amp;H Photo. Plus, enjoy free expedited shipping in the contiguous U.S.Users who were trying to accept new App Store terms and conditions in the wake of the iOS 16 or iOS 15.7 updates were getting blocked by a recurring error.It's been a rocky road to the iOS 16 launch. Here are the high-profile features that didn't debut in the initial release of Apple's operating system.A future update to iOS 16 will make the iPhone even more environmentally friendly, with Clean Energy Charging prioritizing recharging at times when cleaner energy sources are available.In September 2017, Tim Cook said the iPhone X would "set the path for technology for the next decade." Halfway through that decade, it looks like Cook was right.An app called Diffusion Bee lets users run the Stable Diffusion machine learning model locally on their Apple Silicon Mac to create AI-generated art. Here's how to get started.Apple announced iCloud Shared Photo Library as part of iOS 16, but it appears that the feature won't arrive in the iOS 16 release on September 12.An SEC filing from Globalstar reveals that Apple plans to use 85% of its current and future network capacity for its services to iPhone 14 consumers, and pay for future satellite upgrades.It's been a rocky road to the iOS 16 launch. Here are the high-profile features that didn't debut in the initial release of Apple's operating system.Apple's annual update to its operating system brings new features and much-needed changes. Here are the stand-out features in iOS 16.Apple's "Far Out" event is on September 7. Beyond the new iPhone 14, here's what to expect from September's Apple event — and beyond.Apple's iOS 16 will make the iPhone more customizable than ever. This is the ultimate guide on how to make the iPhone a more personal device.The second-generation Razer Kishi is here for iPhone users with a new design, better buttons, and a companion app. How does it stack up to the Backbone One?Less an overhaul and more refining what's already in place, iOS 16 is all about personalization on top of a retained solid foundation.With the SwitchEasy four-in-one MagPower multi-charger, you can power up all your gear with a single device — including your Apple Watch with an Apple-certified puck.The Benks Grand Pro Headphone Stand for AirPods Max is a welcome upgrade over the original. However, it introduces complexity where there was none before — while also ignoring an obvious problem.Keep tabs on the air quality of your home — including potentially deadly radon levels — with the Airthings View Plus.Apple didn't make a Magic Keyboard for iPad mini 6, and Lululook's Magnetic Keyboard perhaps acts as a testament to why.{{ summary }}{{{ reviewStars.html }}}

&nbsp;&nbsp;&nbsp;AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.A number of vulnerabilities have been revealed in Amazon's Alexa, highlighting the need for providers of smart home platforms, such as Apple's , to maintain security as part of the service. The concept of a smart home is attractive, but the dream of ordering a virtual assistant around to automate household tasks becomes a nightmare once security issues surface. In the case...

Alexa hack granted attackers access to an Echo user's smart home network | AppleInsider

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS