Amazon resolves ‘Alexa Skill’ issue which turned the Echo speakers into a spy

Amazon Echo or the Google Home which are backed by voice assistants certainly makes our jobs easier. With a certain set of amazing skill sets the Amazon Alexa and the Google Home does impress the audience out there. However, with the release of new AI-based devices, the security concern among users rises. If you are an Amazon Echo user and fear that your privacy might be a concern then you could be correct.

As per some sources from the web, some researchers have confirmed the fact that Amazon has developed an Alexa skill for the Amazon Echo which allows the smart speakers to indefinitely listen on to a user's conversation. However, it is also being reported that if the users are looking for the same on Alexa skill store which is an app developed for the Echo devices then they will not be able to find it.

The report further suggests that this security flaw was discovered by security experts from a cybersecurity firm Checkmarx, this skill also allows the security experts to convert Alexa into a covert spy by exploiting a vulnerability. This not only allowed them to listen to a users conversation but also transcribe the entire conversation a user had inside their home while sitting right next to the Amazon Echo speaker.

Amazon Echo Plus: How to Setup, Add Skills and Give Commands

Further, the researchers built a normal calculator skill for the Amazon Alexa, however, they managed to add a few lines of malicious code in the same skill set. For example when a user installs the skill and then tries to find a solution for math problems by simply asking Alexa, then the attack or so-called 'spy' mode is enabled on the Amazon Echo.
We all must be aware of that the Amazon Echo speakers are always looking out for the 'Alexa' hotword and get a short window to process the user's query and give them a reply. In this short window, Alexa also keeps a track of what is being said and this is after the recording process has been ended.

The team of researchers were also able to trick Alexa by asking for the calculator skill, by starting a second process using their malicious code and allowing it to run, by cutting off any form of voice prompt from Alexa which informs a user about the microphone being active. However, the second process gave Alexa silent commands to keep on recording even without the Alexa hotword which is really concerning. Amazon, however, has cleared the air that the security flaw has been fixed and that the users need not worry.