Hot answers tagged

25

Absolutely, because: A secure device and channel means that you can trust the data. Yes, the actual temperature is not very private, but an attacker can provide false temperatures and cause an undesirable response (e.g turning heating on unneccesarily). This is how stuxnet worked, by misreporting the speed of the centrifuges, causing the control system to ...


21

According to Jeff Bezos, it's a hardware button, and various sources seem to agree from the teardowns A forum post at the EEVblog forums quotes a video featuring Jeff Bezos, the founder of Amazon: In this video about Jeff Bezos being interviewed by Walter Isaacson at around the 6 min mark, Bezos claims the mute button on the Amazon Echo is physically ...


17

I have been professionally developing a "device that use LTE/3G or other cellular networks" for decades now, and WireShark is one of our major test tools. Data can be encrypted (generally at layer 2, which is an option, or layer 4, by writing code to do so), but much (most?) is not. If I'm worried about a device that could send some personal information ...


16

Yes, it's always listening. No, it's not always sending to the cloud. Obviously the device has to be always listening to detect the wake word. However, that is done by a technology called. How do Amazon Echo and Echo Dot recognize the wake word? Amazon Echo and Echo Dot use on-device keyword spotting to detect the wake word. When these devices detect the ...


15

As I understand the issues, there are two particular points in which the Cayla doll differs from similar allowed toys: The doll has a light indicating when it is sending - but that can be switched off remotely (smart phone app). In addition, lack of bluetooth pairing security (no button press, no PIN) means that it is rather easy for 3rd parties to take ...


12

Is the Echo always recording and sending data to the cloud, or are the above claims unsubstantiated? No on the sending. But yes on the recording. I'm currently developing an Alexa hardware client for a company. The device is always listening. But you'd have to put in a wake word engine on it so that it would "wake up" from the passive listening mode and ...


11

For the My Friend Cayla toy, you can use it without an Internet connection. The FAQ states: Do I need an internet connection to play with Cayla? An internet connection will be required to download the free app which unlocks all of the fun things which Cayla can do. Some functions, such as searching for information on the internet (famous people, ...


10

it's not exactly hidden; the device is advertised as 'smart' and connected to the Internet. Okay but if you're not the one who bought it, you may not be aware that it is recording your speech and sending it to the internet! Just buy one and give it as a gift to someone you wish to spy on; they'll think it's just a doll. Hence, it very much is a hidden ...


10

3g v Wifi Security Standard wifi v LoRaWan/LPWAN If I'm worried about a device that could send some personal information without my consent is unplugging it and returning it to the store the only solution. 3g v Wifi Security It is possible to sniff 3G signals, e.g. , however of more concern might be ensuring the packets cannot be decrypted on the cloud ...


8

On the Voice & Audio section of the Google My Activity page, you can see your history. The recordings it keeps are only after triggering it to wake up with the wake word (OK Google). It also has the ability to delete your history.


8

The news in Germany where reporting that under german laws the doll is considered as hidden espionage device as it looks like a normal toy without any electronical parts to people who do not know about the functions of it, altough it is able to record and send data. This falls under "§ 90 Missbrauch von Sende- oder sonstigen Telekommunikationsanlagen" of ...


8

Sensor reports to a current thermostat reading feel very private to me. A burglar could use the data to find out when a person is at home. After the house got robbed the owner might decide it's a good idea to sue the manufacturer of the thermostat violating their privacy and thus enabling the burglary. Is this the kind of legal risk a manufacturer of the ...


7

I have some skills published for Alexa, so here my understanding... When you use Alexa, it needs to connect to the cloud, where you send whatever you say as a digital signal. How long Amazon will keep this recordings?, good question, not long I guess, they might keep the text?... "As far as I can tell, most data from the Amazon Echo (e.g. recordings of ...


7

If the service you use can tolerate some latency, routing the traffic of your device through the TOR network would make the destination address impossible to determine for your ISP, and the source address (home IP) impossible to determine for the ISP of the server your device is communicating with. If you have only one device in your home, traffic patterns ...


7

The button feels like a momentary push switch and I'm 99% certain that the mute state is reset on a reboot. With both of these in mind I would suggest that it's a software controlled mute rather than physically disconnecting the mic.


6

One of the key issues with My Friend Cayla is that the audio files it sends are not saved securely. Ken Munro has carried out extensive analysis on this (and many other IoT devices) and points out that the audio files are available on the Internet, with poor access controls! So not only is everything your child says going to a server somewhere, others can ...


6

Have to start out by saying, this will have to take place on the router. I looked into the camera, but it simply seems to be too manufacturer set to be able to run a crack that complex on. Perhaps if you did some firmware replacement you could manage, but not simply. With your particular router, it appears that you can. I don't actually have your router, ...


6

Yes, there is advantage to encrypting all communications. You wouldn’t post asking of there is any advantage to locking your house, would you? There question is not of whether, but of how much, advantage there can be. One of the greatest security experts Bruce Schneier, who has a great blog, btw, will tell you that you can't make things totally secure. ...


6

Rather a lot of personal information is collected, according to the Privacy Policy. Here are some of the more sensitive pieces of information collected: When not logged in Birth year Gender Height, weight and activity levels Device identifiers When using 'Enhanced Features' Phone number Nickname, profile image, birthday and country Steps, burned calories,...


5

By saying a key phrase Amazon calls a “wake word” the Echo comes to life and begins listening for commands. By default, the wake word is Alexa. If you reread that last sentence it may not make sense, especially if you are in the security field. According to Amazon, the Echo only listens for commands once it hears its wake word. How does it know when ...


5

In addition to other answers, if the data is sent in plaintext it can be modified. Apart from mentioned problems faking data can cause (turning heat to the max due to lying thermometer in the middle of hot summer might lead to fire hazard, for example) manipulating data can lead to compromise of IoT device, and everything that accesses it (for example, you ...


5

It's always a choice of the designer/developer. But using encryption and other security measures becoming a necessity in these days. As per an example, sensor that reports the current thermostat reading, can be taken control by an intruder to send you false signals. (They can have some strategy to rob you by doing so, who knows ?) You may have heard that ...


5

For devices which are particularly sensitive, a good way to prevent someone from snooping the connection pattern is to generate spoof data, or intentionally skew the connection times (if data need not be uploaded as soon as it is generated). Importantly, you would need to use static payload sizes, or generate plausibly sized payloads for the dummy data too. ...


5

Keeping the device muted when not in use removes a huge amount of the benefit of a voice assistant, if you have to get up, walk across the room and unmute it to use it you might as well just install the app (Alexa app or an Android with Google Assistant) on your phone and only launch it when you want it. If you want a dedicated device that doesn't use the ...


4

What are the steps to the privacy leak described? Basically there are three parts in getting the information described in the paper. An interested party recording the outgoing traffic (2) Said party being able to split the traffic streams (4.1) Analyzing the different traffic streams Identifying device (type) (4.2) Analyzing device pattern (5) Recording ...


4

While I like the use of TOR, you might not be able to configure every device to use it. The simplest way would be to do something at the router, where all traffic, from all devices, enters and exits your house. I would recommend a VPN router. This will encrypt all data leaving your home, so that no one, even you ISP, can see its destination. Data travels, ...


4

Mirai's source code has been released in public, and Jerry Gamblin has kindly created a GitHub repository so that you can easily look through the code for research/academic purposes such as this. I think you'll get the most authoritative answer by dissecting the code to find out how Mirai finds its targets, so I had a little look around and here's what I ...


4

I agree with @hardillb's assessment: it's a software button. I have several basic reasons for believing so: The mute button turns on a red ring light. While it would be possible to do this with a hardware button, it makes more sense logistically to do this with a software button. If I'm not mistaken, the mute button controls the speakers as well as the ...


3

Great question! As has been remarked in the comments, this sounds mostly like a news report rant that hasn't really researched completely. All the articles out there say essentially the same thing: no new research has been done to confirm suspicions, and all articles find their source (eventually) in a single article by abiresearch.com. That article in ...


3

If I ever wanted to sell the Echo, it'd be useful to know what information is on the device, so that I can try to remove it. I think one good option is to deregister the echo device from you Amazon account as this video guide shows. Here are the steps: Go to the Alexa app. Click 'Settings'. Select the device that you want to deregister. Scroll to 'Device ...


Only top voted, non community-wiki answers of a minimum length are eligible