4 ms·

This view of the amazon Echo threat model is very narrow and credits a great deal of trust into Amazon and or how things "should" work. I won't go into the like

This view of the amazon Echo threat model is very narrow and credits a great deal of trust into Amazon and or how things "should" work. I won't go into the likelihood that what I am about to explain is an actual reality, but in practical terms a nation state actor like the NSA can backdoor the Echo. Just because a simple test (disconnecting) the network shows you one behavior means and tells you absolutely nothing about how it could be backdoored. It could be as exotic as a payload deep in the NIC firmware that merely requires the right packet to cross through it completely altering the behavior so it can silently listen. Anyone that can accomplish this much can make the device behave normally until they want it not to. And even then, it will APPEAR normal. It could also be as simple as code Amazon knows about and is compelled by a NSL to never reveal. So, paranoia or likelihood aside, using some cursory behavioral conclusion as an argument is weak at best. We can also talk about phones, laptops and so many other things and why the meme of the echo being /the/ spy device has gained mind share. Anyhow, for the truly paranoid even something like a modern mobile device is a bit of a non-starter.

Natsu 10y ago
Based on the things Snowden leaked, they would backdoor the hardware before it ever reached your home. Or at the design level. A part of me strongly suspects that the Intel IME was dreamed up by the NSA and I'd be very surprised if they don't have a way to own it.
- bitexploder 10y ago
  That would be my suspicion for a well funded nation state as well. The NSA dedicates a non-trivial amount of time to analyzing the chips they source and use in their infrastructure for backdoors. That is not a defensive only capability :)
Pyxl101 10y ago
Is there any special reason to worry about your Echo being backdoored rather than your PC or laptops with their frequently built-in microphones? Heck even my computer monitors seem to have microphones today. I'm sure my PC is a lot easier to break into than the Echo. Depending on how the Echo works, it might not be so easy to back door. It's not likely to be running any system services that can be connected to remotely. It's a pretty simple device without a lot going on internally (compared to a phone or PC). I'd be far more worried about complex electronics like a television or PC being backdoored than an Echo. Furthermore, because these other devices are an order of magnitude more popular, and actually store people's data there's far more incentive for malicious actors of all kinds to develop back doors for them. The Echo is actually a pretty uninteresting target. It doesn't store any data. Maybe you can break into it remotely and use it to listen, but that's it. That's all. You cannot, just by breaking in, sift over a vast trove of preexisting information, like you can with a PC. You'll never steal someone's documents, or read their email, or steal their passwords. Plus if you get into someone's PC or phone you can probably turn on a mic and record them too! I think the Echo honestly has pretty limited value on average as an attack target. It will be low in the priority list for attackers to target. Regardless, if any of these devices are backdoored and recording me, then it will be trivially easy to detect that unexpected network activity. I am far less worried about my Echo than my PC, because I expect my Echo to have zero network activity except when I'm using it. Since it does one thing, it has no excuse for unexpected network activity. It's very easy for me to monitor that network activity - built right into my wireless router. With my PC, who knows what the hell it's doing because some software decided to download an update. PCs and phones are not simple enough that you can expect them to have no network activity when idle. The Echo is simple enough to have no network activity when idle. Because the Echo would be so easy to detect if it were improperly recording you, I do not think a state actor would risk trying to observe anyone security-conscious in that way.
- bitexploder 10y ago
  I can agree with that. SmartTV blasting Netflix. what is a few more bytes. So many more interesting targets.
- redial 10y ago
  > Is there any special reason to worry about your Echo being backdoored rather than your PC or laptops with their frequently built-in microphones? None at all. There is also no reason to exclude the Echo from the list of backdoorable devices.
- pmoriarty 10y ago
  "even my computer monitors seem to have microphones today." Privacy-conscious people need to learn sign language.
WhitneyLand 10y ago
Exactly right, thank you for pointing this out. Also we have to separate assessments of irrational paranoia into pre-Snowden and post-Snowden realities. The lens through which we now view these things is fundamentally different.

Natsu 10y ago

Based on the things Snowden leaked, they would backdoor the hardware before it ever reached your home. Or at the design level. A part of me strongly suspects that the Intel IME was dreamed up by the NSA and I'd be very surprised if they don't have a way to own it.

bitexploder 10y ago
That would be my suspicion for a well funded nation state as well. The NSA dedicates a non-trivial amount of time to analyzing the chips they source and use in their infrastructure for backdoors. That is not a defensive only capability :)

Pyxl101 10y ago

Is there any special reason to worry about your Echo being backdoored rather than your PC or laptops with their frequently built-in microphones? Heck even my computer monitors seem to have microphones today. I'm sure my PC is a lot easier to break into than the Echo. Depending on how the Echo works, it might not be so easy to back door. It's not likely to be running any system services that can be connected to remotely. It's a pretty simple device without a lot going on internally (compared to a phone or PC). I'd be far more worried about complex electronics like a television or PC being backdoored than an Echo. Furthermore, because these other devices are an order of magnitude more popular, and actually store people's data there's far more incentive for malicious actors of all kinds to develop back doors for them. The Echo is actually a pretty uninteresting target. It doesn't store any data. Maybe you can break into it remotely and use it to listen, but that's it. That's all. You cannot, just by breaking in, sift over a vast trove of preexisting information, like you can with a PC. You'll never steal someone's documents, or read their email, or steal their passwords. Plus if you get into someone's PC or phone you can probably turn on a mic and record them too! I think the Echo honestly has pretty limited value on average as an attack target. It will be low in the priority list for attackers to target. Regardless, if any of these devices are backdoored and recording me, then it will be trivially easy to detect that unexpected network activity. I am far less worried about my Echo than my PC, because I expect my Echo to have zero network activity except when I'm using it. Since it does one thing, it has no excuse for unexpected network activity. It's very easy for me to monitor that network activity - built right into my wireless router. With my PC, who knows what the hell it's doing because some software decided to download an update. PCs and phones are not simple enough that you can expect them to have no network activity when idle. The Echo is simple enough to have no network activity when idle. Because the Echo would be so easy to detect if it were improperly recording you, I do not think a state actor would risk trying to observe anyone security-conscious in that way.

bitexploder 10y ago
I can agree with that. SmartTV blasting Netflix. what is a few more bytes. So many more interesting targets.
redial 10y ago
> Is there any special reason to worry about your Echo being backdoored rather than your PC or laptops with their frequently built-in microphones? None at all. There is also no reason to exclude the Echo from the list of backdoorable devices.
pmoriarty 10y ago
"even my computer monitors seem to have microphones today." Privacy-conscious people need to learn sign language.

WhitneyLand 10y ago

Exactly right, thank you for pointing this out. Also we have to separate assessments of irrational paranoia into pre-Snowden and post-Snowden realities. The lens through which we now view these things is fundamentally different.