A recent report from Check Point Security (CHKP) revealed a number of Amazon (AMZN) and Alexa subdomains were vulnerable to a Cross-Origin Resource Sharing (CORS) misconfiguration and Cross Site Scripting (XSS).
The report goes on to say that by using XSS, an attacker would be able to acquire a CSRF token that would provide them access to elements of the smart home installation. Another reminder of the dark side to our increasingly connected Digital Lifestyle and one that also bodes well for those constituents inside the Foxberry Tematica Research Cybersecurity & Data Privacy Index
According to the researchers, these could include automatically installing Alexa skills without the knowledge of the user, acquiring a list of all installed skills, silently removing installed skills, acquiring the victim’s voice history with Alexa, and to even gain personal information.
This skill manipulation can allow for a modified version of an existing skill to be installed and then used by the user, one that could allow actions to be performed by the attacker, or for further acquisition of data from the user. It could even be possible for an attacker to install a skill to eavesdrop into conversations near an Echo device.
“Internet of Things devices are inherently vulnerable and still lack adequate security, which makes them attractive targets to threat actors,” Check Point writes. “Cybercriminals are continually looking for new ways to breach devices, or use them to infect other critical systems. This research presented a weak point in what is a bridge to such IoT appliances. Both the bridge and the devices serve as entry points. They must be kept secured at all times to keep hackers from infiltrating our smart homes.”
Source: Alexa hack granted attackers access to an Echo user’s smart home network | Appleinsider
Related: