Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

Alexa Mishap Hints at Potential Enterprise Security Risk

When Alexa mailed a copy of a couple's conversation to a contact, it raised warning flags for security professionals in organizations.

News this week that an Amazon Echo device had recorded a family's conversation and emailed it to a seemingly random person on their contact list sent a chill among consumers who are adopting these types of Internet of Things devices.

Amazon was able to explain the sequence of events that led to the unfortunate security breach, but many consumers remain skittish about the new voice assistant sitting in their living rooms. Consumers aren't the only ones with a reason to ask questions, however. A growing number of enterprise applications, including SAP and Salesforce.com, have been the target of Echo integration through "skills" - or tasks - that tie Alexa's voice recognition to the application.

According to analysts at Voicebot.ai, in January 2018 there were more than 25,700 skills published in the US. While the vast majority of these are skills for consumer-oriented integration like smart house control, a quick look in the Amazon Alexa Skills Market shows more than 1,000 business skills listed.

"There is a big push by Amazon and other large vendors to incorporate voice assistants into business applications. Voice assistants are a way for vendors to introduce their layer of AI to existing apps and business process," says Chris Morales, head of security analytics at Vectra.

According to Ovum Research, virtual digital assistants will outnumber humans on earth by 2021. Many of them will inevitably join humans in the workplace. As voice assistant use in business is growing, IT security professionals are beginning to pay attention to the devices and their impact on enterprise IT. 

According to Amazon, the Alexa residential data leak came through an almost comical combination of over-sensitive listening device and ignored voice prompts. The consumers spoke strings of sounds that the Echo interpreted as a call to wake up and then various commands, while the humans in the room never heard the Echo's request for confirmation and instruction. Nevertheless, many breaches are built on a foundation of unlikely, yet possible, sequences so the security industry is taking note of the case.

In April, Amazon closed a vulnerability that allowed an Echo to surreptitiously send a transcript of overheard speech to a developer. And in 2017, Google issued a patch for a hardware problem that left a small number of Home Minis constantly recording the speech around them. All of this is interesting, but why should enterprise IT security pros care?

Alexa Goes to Work

A growing number of skills and integrations are being introduced for voice assistants in the office. From Echo integration with Atlassian Build Meister that will allow developers to check on build status with their voice to skills for Slack that let you collaborate with co-workers without ever touching a keyboard, voice assistants are becoming part of many developer and operations offices.

In addition, skills for applications like SAP Concur, Salesforce.com, and Oracle, seem likely to increase voice assistant use beyond the technical teams to employees in various business units with widely differing technology knowledge and skill sets.

With these integrations, one of the concerns some security professionals have is the lack of a direct tie between device and user. "With voice assistants the action or information that is collected needs to audited and tracked to a single user which is must have for enterprise adoption. So effectively we need a strong voice match to a user so that we can associate an action to a user," says Rishi Bhargava, co-founder of Demisto.

That association has more implications for enterprise applications than for most collaboration systems. "The most obvious problem I already see if the lack of voice recognition to a specific user, in particular with Alexa. How do you manage authentication in a conversational interface?" asks Morales.

Vocal Dangers

So what, really, are the dangers of voice assistants in the enterprise? We've seen the possibility of a voice assistant mis-interpreting voice commands (or random words interpreted as voice commands) to record and send information out of the organization. That possibility has already been exploited in demonstrations of exploits that could be used against a company.

Chinese researchers demonstrated that inaudible commands can trigger Siri to act in an exploit they call "Dolphin Attack." This is a specific instance of exploiting a simple fact about the microphones in voice assistants: They can hear a much wider range of frequencies than can humans.

A significant concern comes with the possibility of a headlong rush into voice assistants in the workplace. "Most companies should be cautiously evaluating the use and potential before implementing any voice system into major systems. There needs to be a period of testing and security validation or a business runs the risk of creating a new attack surface they are not prepared to deal with," says Morales.

Bhargava agrees with the idea of cautiously proceeding, but is less optimistic that it will happen. "Security is always an afterthought. This is no different for the voice assistants. In most cases, the adoption will be organic and at some point, the security teams will evaluate and put controls."

One of the greatest conveniences of voice assistants is that they're always there, listening, and ready to respond. So it seems like a paradox to say that one of the greatest security practices is to turn off the microphone. In effect, that means if the individual using the device is leaving for the day, or for an extended period of time, they should turn off the microphone or turn off the device.

So employees should also be made aware, through signage or training, that a listening device is in the office with them. Just as employees have had to be trained to not respond to phishing emails and to follow privacy regulations in communications, the advent of the voice assistant means that IT security has a new area of training to develop and manage for the organization.

Now, if only Alexa could be trained to deliver the classes for them.

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
5/30/2018 | 8:42:51 AM
Must we be TOTALLY INTERNET connected?????
i get along fine with turning on a light switch and having music the old way.  When we travel, I put 5 timers on lights os the house looks more occupied than not.  We have standard home security.  I have an internet of course and WiFi with good password and minimal exposure of private data thorugh good protocols.  And everything else is fine.  So why do we have this madness that everything (!!!!!) has to be accessed through the cell phone.   Doing so in effect then exposes EVERYTHING to out-there.  We are intenet IoT crazy!!!
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:46:42 PM
And now that it's the end of May...
And beyond security, this is why voice-activated "smart assistants" are GDPR and/or other data-regulation violations waiting to happen.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2018 | 9:47:53 PM
Re: Must we be TOTALLY INTERNET connected?????
@REISEN: There are people who will always want the newest, latest, greatest thing.

And then there are people who will follow those people.

And so on from there into widespread mainstream adoption.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
5/31/2018 | 8:34:07 AM
Re: Must we be TOTALLY INTERNET connected?????
There is a big difference between wanting the latest and greatest AND stuff that just works!   
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2018 | 3:30:58 PM
Re: And now that it's the end of May...
Agreed. I don't understand why companies would utilize smart assistants for senstive data anyway.
thuyhoa37
50%
50%
thuyhoa37,
User Rank: Apprentice
6/2/2018 | 3:22:46 PM
Re: Must we be TOTALLY INTERNET connected?????
I agree with your point of views. However, there are a huge number of busy people who can not remember anything. Internet of things help people to reduce time and save more money...
sixscrews
50%
50%
sixscrews,
User Rank: Apprentice
6/5/2018 | 1:12:44 PM
Re: Must we be TOTALLY INTERNET connected?????
No - we must be totally Internet Disconnected.

A persistent Internet connection is an invitation to any creep with access to mess with you. 

Security systems must work 100% of the time but non-authroized access methods need to work only once.

If you aren't using your Internet connection then close it.

And why in heck would you want a controller/device that can be fooled by subvocalizaitons in music or advertisements?

Alexa and Siri are just disasters waiting to happen.

Years ago my family had a party line telephone (yeah, I'm an old guy) and we had to be careful what we said on the 'phone.

The more things change the more they stay the same.

wb/ss

 
PaulChau
50%
50%
PaulChau,
User Rank: Strategist
8/14/2018 | 2:33:02 AM
Re: Must we be TOTALLY INTERNET connected?????
Companies must be smart to know where and when they can use artificial intelligence or bots to handle information. I thin that at the end of the day, people are going to value actual human interaction when it comes to being efficient and getting things done. There are certain things that just need a human touch and getting to the point and understanding what is required is a part of that. The subtle nuances will be tough for a computer program to understand. 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13295
PUBLISHED: 2020-08-10
For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
CVE-2020-6070
PUBLISHED: 2020-08-10
An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerabilit...
CVE-2020-6145
PUBLISHED: 2020-08-10
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2020-8224
PUBLISHED: 2020-08-10
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
CVE-2020-8229
PUBLISHED: 2020-08-10
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.