[mothered]

Greetings to all,

As technology evolves, so too do the opportunities In having a broader range of attack vectors at one's disposal. This time It's Amazon’s Alexa virtual assistant (voice-activated assistant) that's been targeted. A clever and quite effective hack.

Everybody seems to be smitten by new technological elevations, namely voice-enabled digital devices and virtual assistants. But a recent report manifests how “smart” technology could be shockingly blind to security threats. As per reports, researchers discovered a flaw in Amazon’s Alexa virtual assistant that enabled them to eavesdrop on consumers with smart devices – and automatically transcribe every word said, which further a text transcript is generated.

As per Checkmarx Researchers, they were able to manipulate code within a built-in Alexa JavaScript library (ShouldEndSession) to pull off the hack. The JavaScript library is tied to Alexa’s orders to stop listening if it doesn’t hear the user’s command properly. Checkmarx’s tweak to the code simply enabled Alexa to continue listening, no matter the voice request order.

A sample of user’s voice can be collected in various ways, including

• making a spam call
  

• recording person’s voice from a physical proximity of the speaker
  

• mining for audiovisual clips online
  

• compromising cloud servers that store audio information
  

Source.