Privacy Issues and Security Risks in Alexa Skills
Ruhr-Universitaet-Bochum / 2/24/21 / Phys.orgWith the voice commands “Alexa Skills,” users can load numerous extra functions onto their Amazon voice assistant. However, these Skills can often have security gaps and data protection problems, as a team of researchers from the Horst Görtz Institute for IT Security at Ruhr-Universität Bochum (RUB) and North Carolina State University discovered, together with a former Ph.D. student who started to work for Google during the project. They will present their work at the Network and Distributed System Security Symposium (NDSS) conference on 24 February 2021.
Why, that’s today. Thanks for the advance notice.
More than 90,000 Skills analyzed
In their study, the research group of Christopher Lentzsch and Dr. Martin Degeling studied first-time the ecosystem of Alexa Skills. These voice commands are developed not only by the U.S. tech company Amazon itself but also by external providers. Users can download them at a store operated by Amazon directly, and in some cases, they are also activated automatically by Amazon.
The researchers obtained and analyzed 90,194 Skills from the stores in seven country platforms. They found significant deficiencies for safe use. “A first problem is that Amazon has partially activated Skills automatically since 2017. Previously, users had to agree to the use of each Skill. Now they hardly have an overview of where the answer Alexa gives them comes from and who programmed it in the first place,” explains Dr. Martin Degeling from the RUB Chair of System Security.
Aye, there’s the rub!
(How does Dr. Degeling pronounce his name, without getting people to chuckle?)
Unfortunately, it is often unclear which Skill is activated at what time. For example, if you ask Alexa for a compliment, you can get a response from 31 different providers, but it’s not immediately clear which one is automatically selected. Data that is needed for the technical implementation of the commands can be unintentionally forwarded to external providers.
… and we’ll just gloss over the question of why you’d be asking Alexa for a compliment.
Are you sure this isn’t the script for the next James Bond movie?
No Dr Degeling, I’m here to RUB you out!
I mean… No.. No not that. For God’s sake pull up your pants.
— Donald Unpleasance as Dr. Martin Degeling from the RUB Chair of System Security.
— Come to think of it, I wonder why P. Galore never thought of eliminating Bond by that kind of stroke.
Maybe call her sister, Hands Galore.
Or does zee go by Hanz now?
End credits sounds track by Chuck Berry
https://youtu.be/hMddte6yD2w
The man was higher than twelve kites!
I know one skill my Alexa has mastered. Ignoring me. I sometimes have to ask her 3 times to simply shut off a light.
I once asked my buddy’s Alexis to loan me a million dollars. It replied, “Sorry but I seem to have left my wallet at home today.” True story.