Hackers can spy on you via Alexa, Google Assistant

Just recently, the security researchers at SRLabs claimed that a malicious software disguised as a legit Alexa skill or Google action can be used to compromise your Alexa or Google Assistant.

The team shared a series of videos to show that hackers can upload a malicious code into a skill/action and use the same for listening in on private conversations, stealing confidential passwords.

At its core, the attack revolves around using a skill/action to feed the assistant (either of the two) a series of characters they couldn't pronounce.

This ultimately affects the AI in such a way that it continues to listen in on the conversation longer than usual without actually speaking out anything.

The recording is then automatically transcribed and sent to the hacker.

The researchers' videos displayed how this security flaw can be used to steal confidential information.

In one case, a Google action to generate random numbers kept listening on conversations, while in another a Horoscope skill continued recording even after the user commanded 'STOP'.

Two other videos showcased that similar programs can be used to generate fake errors, tricking you into giving away your password.

As both Amazon and Google have extensive checks in place for detecting malicious programs for their respective voice assistants, the security researchers uploaded the malicious code as part of an update for existing skills/actions.

In response, both companies reassured that they take down malicious skills immediately after detection and have mitigation in place to prevent more compromised programs from showing up in the future.