A vulnerability classified as problematic was found in Amazon Echo, Echo Dot, Echo Show and Echo Spot (Artificial Intelligence Software) (the affected version unknown). Affected by this vulnerability is an unknown part of the component Listening. The manipulation with an unknown input leads to a session fixiation vulnerability (Spying). The CWE definition for the vulnerability is CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. As an impact it is known to affect confidentiality. The summary by CVE is:

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range.

The weakness was disclosed 05/30/2018 (Website). It is possible to read the advisory at info.checkmarx.com. This vulnerability is known as CVE-2018-11567 since 05/30/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at info.checkmarx.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment.

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability. Amazon is not certifying skills that do not prompt users for further interaction but remain in listening mode anymore.

Additional details are provided at wired.com.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Amazon

Name

• Echo
• Echo Dot
• Echo Show
• Echo Spot

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion