Alexa, Have You Been Compromised? Hacking Smart Voice Assistants
Hutch investigates the corporate and domestic attack surface of voice assistants like Amazon Alexa, demonstrating skill hijacking and acoustic command injection.
Summary
The Expansion of Voice Assistants into Workplaces
Smart voice assistants (such as Amazon Alexa and Google Assistant) are increasingly deployed in corporate conference rooms and smart offices, listening to sensitive conversations.
Threat Modeling Connected Smart Speakers
Hutch analyzes the multi-layered attack surface of voice assistants—including companion mobile apps, third-party skills, and acoustic physical channels.
Exploiting Malicious Voice Skills and Network Interfaces
The author demonstrates practical exploitation vectors, such as malicious Alexa skill name squatting and local network command injection.
Securing Voice Technologies in Enterprise Environments
The presentation provides enterprise security teams with deployment policies, network isolation guidelines, and physical microphone mute verification.
Related talks
Main Stage·40 min
Cooper Quintin · Yomna Nasser
Shows how modifying an inexpensive consumer 4G LTE mobile hotspot allows researchers to capture raw network packets and detect IMSI catcher surveillance.
Main Stage·20 min
Mike Spicer
Presents three years of wireless traffic analysis from DEF CON, revealing attendee device behavior, probe requests, and passive surveillance capabilities.
Presentations Wireless·27 min
Robert Graham · David Maynor
Robert Graham and David Maynor demonstrate HamSammich, a low-cost long-distance 900MHz point-to-point radio link to proxy Wi-Fi connections and conceal physical location.