Alexa flaws may have let hackers steal voice history
Certain Amazon and Alexa subdomains were vulnerable to cross-origin resource sharing and cross-site scripting attacks
Some Amazon and Alexa subdomains were vulnerable to attack, meaning hackers could have accessed users' voice history on Alexa devices, install third-party apps, and access personal information.
By exploiting cross-origin resource sharing (CORS) misconfiguration, as well as cross-site scripting (XSS) to get a unique CSRF token, hackers were able to perform actions on Alexa devices on a victims’ behalf.
These flaws, which were reported in June and subsequently fixed, could have allowed an attacker to install third-party apps (or skills), get a list of installed apps, remove an installed app, get a victim’s voice history, and access their personal information.
When testing with the Alexa mobile application, researchers with Check Point Research noticed an SSL pinning mechanism which prevented them from inspecting traffic. This was bypassed using a universal unpinning script, with researchers viewing traffic in plain text.
“While looking at the traffic of the application, we found that several requests made by the app had misconfigured the CORS policy, ultimately allowing the sending of Ajax requests from any other Amazon sub-domain,” said security researchers Dikla Barda, Roman Zaikin and Yaara Shriki.
“This could potentially have allowed attackers with code-injection capabilities on one Amazon subdomain to perform a cross-domain attack on another Amazon subdomain.”
One of the requests returned a list of all installed skills on the Alexa device, and also returned the CSRF token. This token was then used to perform actions, such as installing and enabling new skills remotely.
RELATED RESOURCE
The researchers needed to exploit the XSS vulnerability in one of Amazon’s sub-domains for the attack to succeed and use the victim’s identification cookies. From there, they could exploit the CSRF attack and CORS misconfiguration, and perform actions on behalf of the victim on their Alexa account.
Alarmingly, the attack could’ve been conducted using a single malicious link that would direct a victim to the Amazon website, where the attacker had code-injection capabilities. From there, they could conduct various actions including stealing voice history and personal data.
“The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson said.
"We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."
-
Anthropic's Claude Cowork tool is coming to Microsoft CopilotNews The new Copilot Cowork tool will be made available through a new Microsoft 365 tier at the end of March
-
McLaren Racing's Dan Keyworth on how data drives F1 in 2026Interview With new rules to contend with and mounting sensor data, McLaren Racing has doubled down on in-house specialists and partner expertise
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Amazon says Russian-backed threat groups were responsible for five-year-long attacks on edge devices – and it shows a ‘clear evolution in tactics’News Russian-backed hacker groups are exploiting misconfigured edge devices – now preferring that tactic over hunting down traditional vulnerabilities to gain access to company networks.
-
Amazon CSO Stephen Schmidt says the company has rejected more than 1,800 fake North Korean job applicants in 18 months – but one managed to slip through the netNews Analysis from Amazon highlights the growing scale of North Korean-backed "fake IT worker" campaigns
