Defcon 2018: Researchers present attack vulnerabilities in Amazon Echo

The Def Con 2018 security conference on Sunday, saw researchers Tencent's Wu Huiyu and Qian Wenxiang present a way to launch a series of bugs in Amazon Echo, taking over the device, and streaming audio from its microphone to a remote attacker. All this, while the user is completely unaware that the device has been attacked.

As reported by Wired, by joining their doctored Alexa to the same LAN as an unmodified second-generation Alexa device, researchers could use the built in "Whole Home Audio" system to turn their speaker into a listening bug that relayed all audio from the target Alexa speakers, without those target devices giving any indication that they were transmitting.

Investigators' exploitation attempt, exemplifies the exact strategy, which hackers can put into practice to form a deceitful series of bugs, to generate a complicated and elaborate diffusion methodology, which might work against a fairly protected device like the Echo. The alteration of the device begins by altering the chip and the modified chip is soldered to the motherboard.

The researchers also pointed towards a potential "evil maid" attack on Alexa, wherein a hacker can gain physical access to the device and implant malware on it.

Not much to worry for Echo users, as the researchers shared this information with Amazon, before presenting the attack. Amazon has already created and pushed a patch to fix the issue.