藉由智慧音箱竊取隱私之攻擊演示

Demonstration of Privacy Stealing Attack via Smart Speakers

李建賢(Jian-Xian Li) ； 孫沛靖(Pei-Jing Sun) ； 吳介騫(Jieh-Chian Wu)

《資訊安全通訊》 26卷3期 (2020/08) Pp. 1-19

摘要

近年來，智慧音箱的產品逐漸成熟與普及。由於智慧音箱的語音助理一直在聆聽用戶下指令以便啟動服務，這將導致資訊安全上有漏洞。我們發現：小米智慧音箱上連接埠的root簽入密碼，不是沒有設定、就是以特定的方式設定，以至於可以利用系統指令來存取。當我們以root簽入系統後，可以將惡意軟體注入小米智慧音箱系統中，以此達成：在麥克風被設定為關閉的情況下，竊聽用戶與語音助理的對話、並竊取用戶隱私資料。我們演示了三個攻擊場景，分別是：竊聽、魚叉式釣魚、以及被動式釣魚。最後，根據所演示的攻擊，我們分為對於廠商、及用戶，提出建議的緩解方法。

關鍵字

智慧音箱 ； 語音助理 ； 隱私

並列摘要

Recently, the product of smart speakers becomes mature and popular. Since the voice assistant of the smart speaker is always listening to users' commands to issue services, it leads to security vulnerabilities. We find that the login password for root access to the UART ports of the XIAOMI smart speakers is either not configured or configured by certain pattern which can be accessed by using system commands. After login as root, we can inject malware into XIAOMI smart speakers so that we can eavesdrop on conversations between user and voice assistant to perform privacy stealing attack, even when users turn off the microphone. We demonstrate three attack scenarios including eavesdropping, spear phishing, and passive phishing. Finally, we propose mitigations to such attacks for both manufacturers and user.

並列關鍵字

Smart Speaker ； Voice Assistant ； Privacy

參考文獻

CVE-2020-8994: Common Vulnerabilities and Exposures, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8994.(2020/02/14).

CVE-2020-10262: Common Vulnerabilities and Exposures, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10262.(2020/03/10).

CVE-2020-10263: Common Vulnerabilities and Exposures, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10263.(2020/03/10).

Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping: Security Research Labs, https://srlabs.de/bites/smart-spies/.

Speech recognition: Wikipedia, The Free Encyclopedia., https://en.wikipedia.org/w/index.php?title=Speech_recognition&oldid=949143164.(2020/4/4).