Checkmarx researchers including Erez Yalon have created a "rogue Alexa skill" that bypasses Amazon's security checks: it lurks silently and unkillably in the background of your Alexa, listening to all speech in range of it and transcribing it, then exfiltrating the text and audio of your speech to the attacker.
Checkmarx gave Amazon advance notice of the defect they exploited and Amazon has issued a patch; this is the second such flaw known to have been discovered in the Alexa platform. It's not known how many more such defects remain in the platform, or will be introduced in future versions.
Checkmarx did not attempt to get its poisoned skill approved for the Alexa store, so it's not known whether Amazon's internal checks would have detected it. The attack did have a critical weakness: Alexa's blue "listening light" illuminated while it was running; but as the team pointed out, the point of Alexa is that you can use it without looking at it.
One challenge for researchers was the issue of the “reprompt” feature in Alexa. Reprompts are used by Alexa if the service keeps the session open after sending the response but the user does not say anything, so Alexa will ask the user to repeat the order. However, Checkmarx researchers were able to replace the reprompt feature with empty reprompts, so that a listening cycle starts without letting the user know.
Researchers Hacked Amazon’s Alexa to Spy On Users, Again [Lindsey O'Donnell/Threatpost]
(Image: Cryteria, CC-BY)
Dream Askew and Dream Apart are "no-dice, no masters" RPGs where players collaborate to tell stories together without dice or dungeon masters: Dream Askew uses the system to create campaigns in "a queer enclave enduring the collapse of civilization" and Dream Apart is set in "a Jewish shtetl in a fantastical-historical Eastern Europe."
In Gregory Scott Katsoulis's All Rights Reserved, we get all the traditional trappings of a first-rate YA dystopia: grotesque wealth disparity leading to a modern caste system, draconian surveillance to effect social control in an inherently unstable state, ad-driven ubiquitous entertainment as the only distraction from environmental collapse -- but with an important difference.
A sprawling interview with artist and filmmaker Johannes Grenzfurthner on his latest movie Glossary of Broken Dreams.
Businesses big and small use Microsoft Excel for everything from data visualization to bookkeeping, and chances are you’ve already had some exposure to this ubiquitous tool. Whether you’re looking to improve your hiring potential or boost your Excel efficiency, the Ultimate All-Level Excel Bootcamp can get you Excel-savvy with nearly 70 hours of training, and it’s […]
The workday is long, and inevitably, you’re going to find yourself needing to take a break from the daily grind. With Mini Materials Miniature Cinder Blocks, you can take some time for yourself and decompress by turning your desk into a miniature construction site. They’re available today in the Boing Boing Store for $22.49. Handmade […]
Handheld radios might seem a bit archaic, but in an emergency situation, few things will keep you as reliably connected to the outside world. This Emergency Multi-Function Radio & Flashlight takes the utility of the tried-and-true radio and combines it with a powerful flashlight and self-sufficient energy system. It’s available in the Boing Boing Store for […]