SR Labs Demonstrates Phishing and Eavesdropping Attacks on Amazon Echo and Google Home, Leads to Google Action Review and Widespread Outage - Update - Voicebot.ai

Editor's Note: Updated at 6:34 pm EDT on October 21st to include Google's updated statement about the link between the discovered vulnerabilities and the Great Google Action Disappearance saga. Security Research Labs (SR Labs), "a Berlin-based hacking research collective and consulting think tank," revealed yesterday that it had created and received certification for several Alexa skills and Google Actions that exploited security vulnerabilities in the voice assistants. The firm discussed two specific attacks in a blog post related to phishing and eavesdropping. The former demonstrated how a developer, using the standard Alexa Skills Kit (ASK) or Actions on Google (AoG) software development kits, could develop a voice app that tricked a user into thinking that Alexa or Google Assistant were asking for their password to provide a system update. Using similar developer tools, the latter attack could leave a microphone open after a skill seemingly had stopped and conduct passive listening for private information.