论文标题
“你一个人在家吗？” “是”披露Alexa技能中的安全性和隐私漏洞
"Are you home alone?" "Yes" Disclosing Security and Privacy Vulnerabilities in Alexa Skills
论文作者
论文摘要
由于许多有趣的语音激活服务通过特殊应用程序称为技能，因此诸如Amazon Alexa之类的家庭语音助手变得越来越受欢迎。这些技能虽然有用，但也引入了新的安全性和隐私挑战。先前的工作已经证实，Alexa容易受到多种类型的语音攻击，但是使用技能的安全性和隐私风险尚未得到充分研究。在这项工作中，我们研究了一个对手模型，该模型涵盖了三个与隐私相关的漏洞，即资源过度访问，隐藏的代码操作和隐藏的内容操作。通过利用这些漏洞，恶意技能不仅可以绕过审查过程中的安全测试，而且还可以秘密地改变其原始功能，以试图窃取用户的个人信息。使情况更糟的是，攻击可以从虚拟网络扩展到物理世界。我们系统地研究从攻击的可行性和实施到对策设计的安全问题。我们还对亚历克斯技能商店的33,744个技能进行了全面的调查研究。
The home voice assistants such as Amazon Alexa have become increasingly popular due to many interesting voice-activated services provided through special applications called skills. These skills, though useful, have also introduced new security and privacy challenges. Prior work has verified that Alexa is vulnerable to multiple types of voice attacks, but the security and privacy risk of using skills has not been fully investigated. In this work, we study an adversary model that covers three severe privacy-related vulnerabilities, namely,over-privileged resource access, hidden code-manipulation and hidden content-manipulation. By exploiting these vulnerabilities, malicious skills can not only bypass the security tests in the vetting process, but also surreptitiously change their original functions in an attempt to steal users' personal information. What makes the situation even worse is that the attacks can be extended from virtual networks to the physical world. We systematically study the security issues from the feasibility and implementation of the attacks to the design of countermeasures. We also made a comprehensive survey study of 33,744 skills in Alex Skills Store.
