Eight Amazon Alexa and Google Home apps were approved for official app stores even though their actual purposes were eavesdropping and phishing.

Dark Reading Staff, Dark Reading

October 22, 2019

1 Min Read

"Alexa, steal my passwords." It's not a phrase a user is likely to utter, but security researchers in Germany have shown that it's possible for malicious apps — Alexa "skills" and Google Home "actions" — to launch phishing attacks on users, forward the compromised credentials to criminals, and do it all in apps approved for use by the voice-assistant giants.

Security Research Labs, a white-hat research organization, developed a total of eight apps, four each for Amazon Alexa and Google Home, that masqueraded as horoscope checkers or a random number generator. The apps triggered malicious actions based on action words like "stop," while continuing to operate after users thought they had closed.  

According to the researchers, both Amazon and Google removed the malicious apps when presented with evidence of their capabilities. Each of the companies also said they have adjusted practices and policies to prevent similar apps from being added to their stores in the future.

"At this point, consumers have devices that record audio, and often video, in their pockets and homes. We're surrounded nearly 24/7 by devices with the capability to eavesdrop. It should be no surprise that such a broad target surface is attractive to attackers," said Tim Erlin, vice president, product management and strategy at Tripwire, responding to the use of these voice assistants as an attack surface.

Read more here.

Virtual.Event-Fall19-380x50_DRVE.jpg

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights