Threat Intelligence

5/29/2018
06:30 PM
50%
50%

Alexa Mishap Hints at Potential Enterprise Security Risk

When Alexa mailed a copy of a couple's conversation to a contact, it raised warning flags for security professionals in organizations.

News this week that an Amazon Echo device had recorded a family's conversation and emailed it to a seemingly random person on their contact list sent a chill among consumers who are adopting these types of Internet of Things devices.

Amazon was able to explain the sequence of events that led to the unfortunate security breach, but many consumers remain skittish about the new voice assistant sitting in their living rooms. Consumers aren't the only ones with a reason to ask questions, however. A growing number of enterprise applications, including SAP and Salesforce.com, have been the target of Echo integration through "skills" - or tasks - that tie Alexa's voice recognition to the application.

According to analysts at Voicebot.ai, in January 2018 there were more than 25,700 skills published in the US. While the vast majority of these are skills for consumer-oriented integration like smart house control, a quick look in the Amazon Alexa Skills Market shows more than 1,000 business skills listed.

"There is a big push by Amazon and other large vendors to incorporate voice assistants into business applications. Voice assistants are a way for vendors to introduce their layer of AI to existing apps and business process," says Chris Morales, head of security analytics at Vectra.

According to Ovum Research, virtual digital assistants will outnumber humans on earth by 2021. Many of them will inevitably join humans in the workplace. As voice assistant use in business is growing, IT security professionals are beginning to pay attention to the devices and their impact on enterprise IT. 

According to Amazon, the Alexa residential data leak came through an almost comical combination of over-sensitive listening device and ignored voice prompts. The consumers spoke strings of sounds that the Echo interpreted as a call to wake up and then various commands, while the humans in the room never heard the Echo's request for confirmation and instruction. Nevertheless, many breaches are built on a foundation of unlikely, yet possible, sequences so the security industry is taking note of the case.

In April, Amazon closed a vulnerability that allowed an Echo to surreptitiously send a transcript of overheard speech to a developer. And in 2017, Google issued a patch for a hardware problem that left a small number of Home Minis constantly recording the speech around them. All of this is interesting, but why should enterprise IT security pros care?

Alexa Goes to Work

A growing number of skills and integrations are being introduced for voice assistants in the office. From Echo integration with Atlassian Build Meister that will allow developers to check on build status with their voice to skills for Slack that let you collaborate with co-workers without ever touching a keyboard, voice assistants are becoming part of many developer and operations offices.

In addition, skills for applications like SAP Concur, Salesforce.com, and Oracle, seem likely to increase voice assistant use beyond the technical teams to employees in various business units with widely differing technology knowledge and skill sets.

With these integrations, one of the concerns some security professionals have is the lack of a direct tie between device and user. "With voice assistants the action or information that is collected needs to audited and tracked to a single user which is must have for enterprise adoption. So effectively we need a strong voice match to a user so that we can associate an action to a user," says Rishi Bhargava, co-founder of Demisto.

That association has more implications for enterprise applications than for most collaboration systems. "The most obvious problem I already see if the lack of voice recognition to a specific user, in particular with Alexa. How do you manage authentication in a conversational interface?" asks Morales.

Vocal Dangers

So what, really, are the dangers of voice assistants in the enterprise? We've seen the possibility of a voice assistant mis-interpreting voice commands (or random words interpreted as voice commands) to record and send information out of the organization. That possibility has already been exploited in demonstrations of exploits that could be used against a company.

Chinese researchers demonstrated that inaudible commands can trigger Siri to act in an exploit they call "Dolphin Attack." This is a specific instance of exploiting a simple fact about the microphones in voice assistants: They can hear a much wider range of frequencies than can humans.

A significant concern comes with the possibility of a headlong rush into voice assistants in the workplace. "Most companies should be cautiously evaluating the use and potential before implementing any voice system into major systems. There needs to be a period of testing and security validation or a business runs the risk of creating a new attack surface they are not prepared to deal with," says Morales.

Bhargava agrees with the idea of cautiously proceeding, but is less optimistic that it will happen. "Security is always an afterthought. This is no different for the voice assistants. In most cases, the adoption will be organic and at some point, the security teams will evaluate and put controls."

One of the greatest conveniences of voice assistants is that they're always there, listening, and ready to respond. So it seems like a paradox to say that one of the greatest security practices is to turn off the microphone. In effect, that means if the individual using the device is leaving for the day, or for an extended period of time, they should turn off the microphone or turn off the device.

So employees should also be made aware, through signage or training, that a listening device is in the office with them. Just as employees have had to be trained to not respond to phishing emails and to follow privacy regulations in communications, the advent of the voice assistant means that IT security has a new area of training to develop and manage for the organization.

Now, if only Alexa could be trained to deliver the classes for them.

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sixscrews
50%
50%
sixscrews,
User Rank: Apprentice
6/5/2018 | 1:12:44 PM
Re: Must we be TOTALLY INTERNET connected?????
No - we must be totally Internet Disconnected.

A persistent Internet connection is an invitation to any creep with access to mess with you. 

Security systems must work 100% of the time but non-authroized access methods need to work only once.

If you aren't using your Internet connection then close it.

And why in heck would you want a controller/device that can be fooled by subvocalizaitons in music or advertisements?

Alexa and Siri are just disasters waiting to happen.

Years ago my family had a party line telephone (yeah, I'm an old guy) and we had to be careful what we said on the 'phone.

The more things change the more they stay the same.

wb/ss

 
thuyhoa37
50%
50%
thuyhoa37,
User Rank: Apprentice
6/2/2018 | 3:22:46 PM
Re: Must we be TOTALLY INTERNET connected?????
I agree with your point of views. However, there are a huge number of busy people who can not remember anything. Internet of things help people to reduce time and save more money...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2018 | 3:30:58 PM
Re: And now that it's the end of May...
Agreed. I don't understand why companies would utilize smart assistants for senstive data anyway.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
5/31/2018 | 8:34:07 AM
Re: Must we be TOTALLY INTERNET connected?????
There is a big difference between wanting the latest and greatest AND stuff that just works!   
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:47:53 PM
Re: Must we be TOTALLY INTERNET connected?????
@REISEN: There are people who will always want the newest, latest, greatest thing.

And then there are people who will follow those people.

And so on from there into widespread mainstream adoption.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:46:42 PM
And now that it's the end of May...
And beyond security, this is why voice-activated "smart assistants" are GDPR and/or other data-regulation violations waiting to happen.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
5/30/2018 | 8:42:51 AM
Must we be TOTALLY INTERNET connected?????
i get along fine with turning on a light switch and having music the old way.  When we travel, I put 5 timers on lights os the house looks more occupied than not.  We have standard home security.  I have an internet of course and WiFi with good password and minimal exposure of private data thorugh good protocols.  And everything else is fine.  So why do we have this madness that everything (!!!!!) has to be accessed through the cell phone.   Doing so in effect then exposes EVERYTHING to out-there.  We are intenet IoT crazy!!!
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Major International Airport System Access Sold for $10 on Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  7/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14373
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. In TIFFFindField in tif_dirinfo.c, the structure tif is being dereferenced without first checking that the structure is not empty and has the requested fields (tif_foundfield). In the call sequences following from the affected library functions (TIFFVGetFiel...
CVE-2018-14374
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow can occur via an empty fmt argument to unixErrorHandler in tif_unix.c, and it can be exploited (at a minimum) via the following high-level library API functions: TIFFClientOpen, TIFFFdOpen, TIFFRawStripSize, TIFFCheckTile, TIFFComputeStrip,...
CVE-2018-14375
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow vulnerability can occur via an invalid or empty tif argument to TIFFRGBAImageOK in tif_getimage.c, and it can be exploited (at a minimum) via the following high-level library API functions: TIFFReadRGBAImage, TIFFRGBAImageOK, and TIFFRGBAIm...
CVE-2018-14378
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow can occur via an invalid or empty tif argument to TIFFWriteBufferSetup in tif_write.c, and it can be exploited (at a minimum) via the following high-level library API function: TIFFWriteTile.
CVE-2018-14363
PUBLISHED: 2018-07-17
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.