Alexa Skill Developed to Eavesdrop on Conversations, Amazon Fixes Vulnerability

Amazon has undoubtedly made our lives a little easier by letting Alexa hear what we need - whether it's the latest news headlines or weather updates, or some random jokes - and respond accordingly. But the ability to listen to our words could become dangerous if it works in an always-on mode. This is what some security researchers have discovered by creating a 'skill' that enabled Echo devices to eavesdrop on conversations. The skill leveraged a reported vulnerability that made Alexa active even after ending a session.

The researchers at cyber-security company Checkmarx hid the malicious application in a simple calculator skill that is meant to solve common mathematics problems. While Alexa is designed to process commands after hearing the "Alexa" wake word and ends the session or wait for another command for a brief moment after processing the first command, the skill in question kept it waiting long after the last communication. The skill also enabled voice recording, without informing users. All this made it possible for the researchers to silently capture conversations from Alexa.

The Echo speakers on which the reported skill is installed show a sign of activeness by illuminating the blue light. But, of course, this may easily be ignored by users.

Thankfully, Amazon has addressed the issue after receiving its report from the Checkmarx team and has tweaked Alexa to shut down any uncommon sessions in which the microphone receives responses for a longer-than-usual time. In a statement to Gizmodo, an Amazon spokesperson assured customer trust as a priority for the company. "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behaviour and reject or suppress those skills when we do," the spokesperson said.

However, Amazon is yet to make stringent rules and regulations for developers building new Alexa skills. The company is also receiving requests for giving data from Alexa to authorities.

That being said, voice-based virtual assistants including Amazon's Alexa need to offer a high-level security as they are about to become an important part of human lives. In addition to their presence on smart speakers such as Amazon Echo lineup and Google Home, voice assistants are getting expanded to PCs, smart screens, and last but not the least - smartphones.