Turning Alexa bad: Check Point Research finds vulnerabilities in certain Amazon Alexa subdomains
Check Point Research has identified significant security vulnerabilities in certain Amazon/Alexa subdomains that could allow hackers to access personal information and control user accounts. The vulnerabilities enable attackers to install and remove skills, extract voice histories, and gain access to sensitive data with just one click on a malicious link. Over 200 million Alexa devices are in use globally, making them substantial targets for cyber threats. Amazon responded swiftly to close these vulnerabilities, underscoring the importance of securing smart devices in maintaining user privacy.
- Amazon quickly addressed the identified vulnerabilities, enhancing user security.
- The swift response from Amazon demonstrates commitment to user privacy and device security.
- Exposed vulnerabilities could have led to significant personal data breaches for Alexa users.
- The presence of such vulnerabilities raises concerns about the security of smart devices in general.
SAN CARLOS, Calif., Aug. 13, 2020 (GLOBE NEWSWIRE) -- Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, recently identified security vulnerabilities in certain Amazon/Alexa subdomains that would have allowed a hacker to remove/install skills on the targeted victim’s Alexa account, access their voice history and personal data. The attack required a single click by the user on a malicious link crafted by the hacker and voice interaction by the victim.
With over 200 million sold globally, Alexa is capable of voice interaction, setting alerts, music playback, and controlling smart devices in a home automation system. Users can extend Alexa’s capabilities by installing ‘skills.’ which are voice-driven apps. However, the personal information stored in users’ Alexa accounts and the device’s use as a home automation controller makes them an attractive target for hackers.
Check Point researchers demonstrated how the vulnerabilities they found in certain Amazon/Alexa subdomains could be exploited by a hacker crafting and sending a malicious link to a target user, which appears to come from Amazon. If the user clicks the link, the attacker can then:
- Access a victim’s personal information, such as banking data history, usernames, phone numbers and home address
- Extract a victim’s voice history with their Alexa
- Silently install skills (apps) on a user’s Alexa account
- View the entire skill list of an Alexa user’s account
- Silently remove an installed skill
“Smart speakers and virtual assistants are so commonplace that it’s easy to overlook just how much personal data they hold, and their role in controlling other smart devices in our homes. But hackers see them as entry points into peoples’ lives, giving them the opportunity to access data, eavesdrop on conversations or conduct other malicious actions without the owner being aware,” said Oded Vanunu, Head of Products Vulnerabilities Research at Check Point. “We conducted this research to highlight how securing these devices is critical to maintaining users’ privacy. Thankfully, Amazon responded quickly to our disclosure to close off these vulnerabilities on certain Amazon/Alexa subdomains. We hope manufacturers of similar devices will follow Amazon’s example and check their products for vulnerabilities that could compromise users’ privacy. Previously, we conducted research on Tiktok, WhatsApp and Fortnite. Alexa has concerned us for a while now, given its ubiquity and connection to IoT devices. It’s these mega digital platforms that can hurt us the most. Therefore, their security levels are of crucial importance.”
Amazon fixed this issue soon after it was reported.
For details of the vulnerabilities and a video showing how they could have been exploited, visit https://research.checkpoint.com
Follow Check Point Research via:
Blog: https://research.checkpoint.com/
Twitter: https://twitter.com/_cpresearch
About Check Point Research
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.
About Check Point Software Technologies Ltd.
Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to governments and corporate enterprises globally. Check Point’s solutions protect customers from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and advanced targeted threats. Check Point offers a multilevel security architecture, “Infinity Total Protection with Gen V advanced threat prevention”, this combined product architecture defends an enterprises’ cloud, network and mobile devices. Check Point provides the most comprehensive and intuitive one point of control security management system. Check Point protects over 100,000 organizations of all sizes.
| MEDIA CONTACT: | INVESTOR CONTACT: |
| Ekram Ahmed | Kip E. Meintzer |
| Check Point Software Technologies | Check Point Software Technologies |
| press@checkpoint.com | ir@us.checkpoint.com |
FAQ
What security vulnerabilities were found in CHKP's recent report?
How did Amazon respond to the vulnerabilities reported by Check Point Research?
What potential risks do the identified vulnerabilities pose to Alexa users?
Why are smart devices like Alexa considered vulnerable?
