Recently, a report from Wired stated that a British security researcher, Mark Barnes, has conducted a detailed study on a method to compromise the Amazon Echo. This method allows anyone to install malware on the Echo, enabling them to listen in on conversations without the user’s knowledge and transmit the microphone data to a third-party device.
Doesn’t that sound a bit scary? Consider that in China, the smart speaker competition has already begun, and it may not be long before every household has a smart speaker. Does this mean that similar situations could arise in domestic households? The idea that someone could eavesdrop on your home without your knowledge is indeed worth discussing.
A “Hard” Transformation Scheme for Devices
Transforming a device like the Echo into an “eavesdropper” is certainly not the intention of ordinary users, as no one wants their life to be monitored by strangers. However, when Mark Barnes attempted to hack the Echo, it should make you realize that even products like smart speakers carry potential risks, which may be as significant as the theft of information from mobile phones.
The method of hacking is quite “hard” or somewhat “brutal”. According to Barnes, he first needed to disassemble the Echo by removing a metal pad from the bottom of the speaker. After removing the pad, he inserted an SD card to rewrite the original Echo firmware, which required preloading a new “bootloader” onto the SD card to disable the authentication in the original operating system and allow the device to run unauthorized software.
The entire process seems easy but is actually time-consuming. Barnes stated that he spent several hours disassembling and soldering to avoid leaving obvious traces. However, once you understand the core principle of this hack, it can be accomplished in a few minutes using simpler methods.
It is worth noting that this hacking method exploits a vulnerability in Echo devices manufactured before 2017, meaning it can only successfully hack the 2015/2016 models. However, once successfully hacked, you can “almost make it do anything you want”.
Once hacked, audio data from users’ homes will be transmitted to any remote computer. Moreover, it can remotely control the smart speaker to perform malicious functions, such as turning on the TV or air conditioning, which means that scenarios previously depicted in films could indeed occur in the real world.
In fact, at the Baidu AI Developer Conference in early July, Baidu demonstrated a product running DuerOS that was compatible with Amazon Alexa. By modifying just 17 lines of code, they could connect to Baidu’s Alexa-compatible services, allowing an overseas smart speaker to directly implement Chinese voice interaction and provide services. This further proves the possibility of modifying smart speaker systems.
After Barnes released his hacking news, Amazon issued a statement regarding the incident, advising users to purchase Amazon devices only from official or authorized sellers and to keep their software updated. This seems to be the best temporary decision, but to prevent such incidents, companies like Amazon need to exercise greater caution regarding security.
Not Just Smart Speakers Are Worth Noting
The sales of smart speakers highlight the urgency of the situation. Since the official launch of the Echo at the end of 2014, over 7 million units have been shipped globally in just over two years. Looking at the domestic situation this year, the smart speaker market is expected to become exceptionally competitive in the second half of the year, with giants like Alibaba, Baidu, and Xiaomi eager to enter the fray.
It can be said that smart speaker products, led by the Amazon Echo, have already become essential in some people’s daily lives. However, we should also note that beyond smart speakers, modern homes are increasingly occupied by various smart products. Not only speakers, but previous incidents of privacy breaches involving other smart home devices are also worth our vigilance.
In March of this year, the well-known whistleblower site WikiLeaks released a large number of documents from the CIA, revealing that the CIA had created a cyber arsenal using hacking techniques and had infiltrated smartphones and computers worldwide through malware and trojans.
Among these, it is noteworthy that the CIA collaborated with the British security agency (MI5) to develop a tool called “Weeping Angel” that can remotely control Samsung F8000 smart TVs, turning them into secret recording devices that can record conversations without the knowledge of the people in the room. This tool can also infiltrate the electronic control systems of cars and trucks.
While government surveillance of personal information may serve a certain purpose in maintaining social security and stability, and most people’s lives seem unaffected, we should still remember that the “WannaCry” ransomware attack that caused global panic this year originated from tools stolen from the NSA.
Convenience or Security?
So, let’s reflect on our daily lives. If we hold smart phones, have smart TVs and smart speakers at home, and in the future drive smart cars, when everything becomes intelligent and convenient due to technological advancements, we must not overlook the potential losses we face in the event of a security incident. How can we balance convenience and security?
To address this issue, Geek Park interviewed Song Shaopeng, founder of Shenzhen Sugr Mitang Technology, a company focused on providing solutions for smart speakers and other products. He stated that products like the Echo, once they reach a certain sales volume, are as susceptible to hacking as Xbox and PlayStation. From a security perspective, in addition to the common combination of software systems and hardware-level (chip encryption), smart speakers and similar products need to ensure cloud security.
“At the chip level, both processing chips and storage are encrypted using technical means; at the software level, whether it’s Bluetooth or Wi-Fi, a key transmission method is used when connecting to mobile apps; at the cloud level, AWS is used for secure deployment. Of course, these measures still need to be iterated to achieve better results,” Song Shaopeng told us, which is what they can currently offer in their solutions.
When asked how users can protect their privacy while using smart speakers (and other smart products), Geek Park also interviewed Wang Yangdong, head of the cloud security team at 360 Information Security. He provided the following suggestions:
-
First, ensure that your devices are not maliciously accessed by untrusted individuals, as some hacking actions require physical contact with the device and disassembly;
-
Some smart hardware devices may be attacked due to vulnerabilities at the network level, so users should set complex Wi-Fi passwords (in most cases, devices can only be attacked when connected to the same Wi-Fi network);
-
Regularly update device systems to keep the firmware up to date with the latest official version.
Additionally, Wang Yangdong mentioned that since smart speakers have voice recognition and interaction functions, they need to recognize the content of household conversations. Therefore, many products on the market with voice recognition capabilities transmit users’ voice data and corresponding text data in plaintext over the network during voice recognition.
This can lead to any node in the communication chain between the device and the server being able to access the content of household conversations. In the design of features involving user privacy data, data transmission must use strong encryption methods to prevent others from eavesdropping on household conversations over the network, avoiding privacy breaches. This is also an area where manufacturers need to strengthen their capabilities in the cloud.
The relationship between technological advancement and privacy protection is a “delicate balance” on opposite ends of a scale. We often say that the rise of new technologies continuously “steals” our privacy, whether it’s the computers of the past, the smartphones of today, or the various smart home terminals like smart speakers in the future. While enjoying the convenience brought by technology, it is always wise to remain vigilant about security, but we should not panic excessively. As long as we pay attention during purchase, daily use, and regular maintenance, security can still be ensured.
(Editor: Rubberso)
■
