Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

Alexa Mishap Hints at Potential Enterprise Security Risk

When Alexa mailed a copy of a couple's conversation to a contact, it raised warning flags for security professionals in organizations.

News this week that an Amazon Echo device had recorded a family's conversation and emailed it to a seemingly random person on their contact list sent a chill among consumers who are adopting these types of Internet of Things devices.

Amazon was able to explain the sequence of events that led to the unfortunate security breach, but many consumers remain skittish about the new voice assistant sitting in their living rooms. Consumers aren't the only ones with a reason to ask questions, however. A growing number of enterprise applications, including SAP and Salesforce.com, have been the target of Echo integration through "skills" - or tasks - that tie Alexa's voice recognition to the application.

According to analysts at Voicebot.ai, in January 2018 there were more than 25,700 skills published in the US. While the vast majority of these are skills for consumer-oriented integration like smart house control, a quick look in the Amazon Alexa Skills Market shows more than 1,000 business skills listed.

"There is a big push by Amazon and other large vendors to incorporate voice assistants into business applications. Voice assistants are a way for vendors to introduce their layer of AI to existing apps and business process," says Chris Morales, head of security analytics at Vectra.

According to Ovum Research, virtual digital assistants will outnumber humans on earth by 2021. Many of them will inevitably join humans in the workplace. As voice assistant use in business is growing, IT security professionals are beginning to pay attention to the devices and their impact on enterprise IT. 

According to Amazon, the Alexa residential data leak came through an almost comical combination of over-sensitive listening device and ignored voice prompts. The consumers spoke strings of sounds that the Echo interpreted as a call to wake up and then various commands, while the humans in the room never heard the Echo's request for confirmation and instruction. Nevertheless, many breaches are built on a foundation of unlikely, yet possible, sequences so the security industry is taking note of the case.

In April, Amazon closed a vulnerability that allowed an Echo to surreptitiously send a transcript of overheard speech to a developer. And in 2017, Google issued a patch for a hardware problem that left a small number of Home Minis constantly recording the speech around them. All of this is interesting, but why should enterprise IT security pros care?

Alexa Goes to Work

A growing number of skills and integrations are being introduced for voice assistants in the office. From Echo integration with Atlassian Build Meister that will allow developers to check on build status with their voice to skills for Slack that let you collaborate with co-workers without ever touching a keyboard, voice assistants are becoming part of many developer and operations offices.

In addition, skills for applications like SAP Concur, Salesforce.com, and Oracle, seem likely to increase voice assistant use beyond the technical teams to employees in various business units with widely differing technology knowledge and skill sets.

With these integrations, one of the concerns some security professionals have is the lack of a direct tie between device and user. "With voice assistants the action or information that is collected needs to audited and tracked to a single user which is must have for enterprise adoption. So effectively we need a strong voice match to a user so that we can associate an action to a user," says Rishi Bhargava, co-founder of Demisto.

That association has more implications for enterprise applications than for most collaboration systems. "The most obvious problem I already see if the lack of voice recognition to a specific user, in particular with Alexa. How do you manage authentication in a conversational interface?" asks Morales.

Vocal Dangers

So what, really, are the dangers of voice assistants in the enterprise? We've seen the possibility of a voice assistant mis-interpreting voice commands (or random words interpreted as voice commands) to record and send information out of the organization. That possibility has already been exploited in demonstrations of exploits that could be used against a company.

Chinese researchers demonstrated that inaudible commands can trigger Siri to act in an exploit they call "Dolphin Attack." This is a specific instance of exploiting a simple fact about the microphones in voice assistants: They can hear a much wider range of frequencies than can humans.

A significant concern comes with the possibility of a headlong rush into voice assistants in the workplace. "Most companies should be cautiously evaluating the use and potential before implementing any voice system into major systems. There needs to be a period of testing and security validation or a business runs the risk of creating a new attack surface they are not prepared to deal with," says Morales.

Bhargava agrees with the idea of cautiously proceeding, but is less optimistic that it will happen. "Security is always an afterthought. This is no different for the voice assistants. In most cases, the adoption will be organic and at some point, the security teams will evaluate and put controls."

One of the greatest conveniences of voice assistants is that they're always there, listening, and ready to respond. So it seems like a paradox to say that one of the greatest security practices is to turn off the microphone. In effect, that means if the individual using the device is leaving for the day, or for an extended period of time, they should turn off the microphone or turn off the device.

So employees should also be made aware, through signage or training, that a listening device is in the office with them. Just as employees have had to be trained to not respond to phishing emails and to follow privacy regulations in communications, the advent of the voice assistant means that IT security has a new area of training to develop and manage for the organization.

Now, if only Alexa could be trained to deliver the classes for them.

Related content:

Curtis Franklin Jr. is Senior Analyst at Omdia, focusing on enterprise security management. Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
8/14/2018 | 2:33:02 AM
Re: Must we be TOTALLY INTERNET connected?????
Companies must be smart to know where and when they can use artificial intelligence or bots to handle information. I thin that at the end of the day, people are going to value actual human interaction when it comes to being efficient and getting things done. There are certain things that just need a human touch and getting to the point and understanding what is required is a part of that. The subtle nuances will be tough for a computer program to understand. 
User Rank: Apprentice
6/5/2018 | 1:12:44 PM
Re: Must we be TOTALLY INTERNET connected?????
No - we must be totally Internet Disconnected.

A persistent Internet connection is an invitation to any creep with access to mess with you. 

Security systems must work 100% of the time but non-authroized access methods need to work only once.

If you aren't using your Internet connection then close it.

And why in heck would you want a controller/device that can be fooled by subvocalizaitons in music or advertisements?

Alexa and Siri are just disasters waiting to happen.

Years ago my family had a party line telephone (yeah, I'm an old guy) and we had to be careful what we said on the 'phone.

The more things change the more they stay the same.


User Rank: Apprentice
6/2/2018 | 3:22:46 PM
Re: Must we be TOTALLY INTERNET connected?????
I agree with your point of views. However, there are a huge number of busy people who can not remember anything. Internet of things help people to reduce time and save more money...
User Rank: Ninja
5/31/2018 | 3:30:58 PM
Re: And now that it's the end of May...
Agreed. I don't understand why companies would utilize smart assistants for senstive data anyway.
User Rank: Ninja
5/31/2018 | 8:34:07 AM
Re: Must we be TOTALLY INTERNET connected?????
There is a big difference between wanting the latest and greatest AND stuff that just works!   
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:47:53 PM
Re: Must we be TOTALLY INTERNET connected?????
@REISEN: There are people who will always want the newest, latest, greatest thing.

And then there are people who will follow those people.

And so on from there into widespread mainstream adoption.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:46:42 PM
And now that it's the end of May...
And beyond security, this is why voice-activated "smart assistants" are GDPR and/or other data-regulation violations waiting to happen.
User Rank: Ninja
5/30/2018 | 8:42:51 AM
Must we be TOTALLY INTERNET connected?????
i get along fine with turning on a light switch and having music the old way.  When we travel, I put 5 timers on lights os the house looks more occupied than not.  We have standard home security.  I have an internet of course and WiFi with good password and minimal exposure of private data thorugh good protocols.  And everything else is fine.  So why do we have this madness that everything (!!!!!) has to be accessed through the cell phone.   Doing so in effect then exposes EVERYTHING to out-there.  We are intenet IoT crazy!!!
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.