Echo Security Concerns

Earlier this month SlashGear reported on Echo owner Robert Paradiso, who hacked together an Echo / Raspberry Pi system for controlling a power wheelchair with his voice.

Here’s the video, from YouTube.

 

 

Paradiso explains in the video description: “Using a Raspberry Pi running a Hue emulator, Echo ‘thinks’ it’s turning lights on and off but is really in effect controlling a wheelchair. The control scheme is direction (forward, reverse, left, or right) followed by duration in seconds (one, two, three, or four).”

This hack got a lot of developers excited about the Echo’s potential, and a lot of consumers worried about the larger security implications. Could someone use this hack to remotely control a power wheelchair without the wheelchair owner’s permission? No, not in its current form; Paradiso had to have access to both the Echo and the chair to set this up, it’s a unique hack that only works for this one chair, and it wasn’t simple to do.

But it does raise some red flags.

 


Image credit: Veritas Domain

 

Amazon Introduces An Echo Security Help Page
Now that Echo owners are using the device for smart home controls that include opening and closing garage doors, tracking information about their car’s location and opening and closing smart locks, Amazon is fielding more and more questions from consumers about potential Echo security breaches.

For example, in theory, if you’re using an Echo to control smart home locks or your garage door and have an Echo positioned near a window in your home, someone standing outside the window could speak loudly enough to wake the Echo and issue an unlock command.

Similarly, in theory, a canny thief might access the Automatic skill (if you have it enabled, along with the Automatic Connected Car Adapter) with a hacked version of the Automatic mobile app to access your car’s onboard computer data or view a map of your car’s location.

A crook might issue commands to an Echo while the owner’s away via a speakerphone answering machine (yes, many people still have these), if the Echo is positioned nearby.

To address potential security issues, Amazon’s created a “Safety Information” Echo help page. Here’s the text of that page, as of this writing (on 11/20/15):


Please follow these guidelines when using connected home devices with Alexa.

When you connect devices and services to Alexa, anyone speaking to Alexa can operate those products. This includes products such as garage doors, locks, and appliances. Please follow these recommendations when using connected devices with Alexa:

– Follow all instructions and recommended uses for connected home devices.

– After making a request, confirm the action was completed on the connected home device.

– Take steps to ensure the security of your Alexa supported device and safe operation of your connected products. For example, if you do not want Alexa to respond to voice commands (like when you are away from home), turn off microphones on your Alexa supported device.


These are important pointers, particularly the one about turning off the Echo’s microphone when you’re away from home.

 

 

Implications and Unintended Consquences
To date, there have been no reports of Echos being used for nefarious activity. However, as with any new kind of technology, thieves, hackers and scammers are sure to be on the lookout for any opportunistic loopholes that can make their work easier.

If you’re using your Echo for smart home controls or to control appliances:

1. Don’t position any Echo near a window.

2. Don’t position any Echo near a speakerphone answering machine.

3. Use the mute button on the top of the Echo when you’ll be away from home to avoid unwanted wakes/usage.

 

Technological conveniences bring a certain amount of responsibility with them, but a few common sense precautions are all it takes to keep your Echo secure.

 

* * *

The ECEENĀ® Solar Bag, Solar Charger Backpack With 7 Watts Solar Panel is just the thing for outdoorsy types who want to take their tech along for the hike, bike ride, camping trip or day trip. It’s currently (as of 11/20/15) rated 4/5 stars and is currently on sale at 25% off: priced at $119.99 instead of the usual $159.96. Charges any devices with USB charging capability.

Advertisements make it possible for Love My Echo to bring you great content for free, so thanks for your support.

* * *