How this Amazon Echo speaker hack could be used to record your every word

When a device is permanently listening to everything that’s happening in your home then you better be sure that it’s secure.

However, researchers from MWR InfoSecurity have discovered a way to hack into the Amazon Echo, giving them the ability to install software that could allow them to listen to, and record, everything that the Echo hears – even if the speaker's usual trigger word has not been activated.

There are a couple of caveats to this hack. First is that it can’t be done remotely. This is a hack that requires direct access to the Amazon Echo speaker, where the potential hacker will need to remove the rubber base of the speaker to reveal its debug pads.

The second caveat is that this hack is only possible on 2015 and 2016 versions of the full-size Echo device (the Echo Dot is not affected). The copyright year on the packaging should tell you what year the device was manufactured in. The vulnerability doesn’t exist in the 2017 model of the speaker.

However, with an estimated 10 million Alexa-equipped devices sold as of May 2017, that's potentially a lot of vulnerable devices on the market.

An invisible hack

There are a number of opportunities a hacker may have to compromise a device. When we spoke to MWR InfoSecurity they suggested that a hacker may intercept the speaker when it’s on its way to a customer, or else buy one, compromise it, and then sell it on as a second hand device to an unsuspecting consumer.

Once the compromised device is in your home however there’s very little to let you know that it’s sending your voice data to anyone other than Amazon. It still responds as usual to voice commands, and its blue light gives no indication that it’s recording you at all times.

Reassuringly since the device’s mute button is a physical switch, and a representative from MWR InfoSecurity confirmed that using it would prevent a hacker from listening in.

Responding to the hack, Amazon commented, "Customer trust is very important to us. To help ensure the latest safeguards are in place, as a general rule, we recommend customers purchase Amazon devices from Amazon or a trusted retailer and that they keep their software up-to-date.”

Pratical safeguards

Since the hack relies upon getting physical access to the device, it shouldn’t be too difficult to minimise your risk of being affected.

You can do so by making sure you only buy Amazon Echo devices that are new and directly sold by Amazon, and returning them if the box’s seal is broken. Buying the device second hand raises the risk of someone else having compromised it.

It’s not clear whether Amazon’s refurbishing process involves checking the device for malicious software. We have contacted Amazon for clarification and will update this peace when it responds.

Detective Alexa

The Amazon Echo has already been the source of some security concerns. Last year it’s recording data was requested by police investigating a murder case. Amazon initially refused, citing customer privacy, but later consented after the defendant in the case consented to the data being used.

However, even in this case the speaker would only have been recording after it heard its ‘wake’ word. This more recent hack allows the device to record constantly.

The numerous caveats of the hack mean that it’s unlikely to become a widespread issue, but it should come as a potent reminder that if you’re putting a device with a microphone in it in your home that you should be extra careful about its security.