3 ms·

I worked on the Echo firmware and cloud software. Let me definitively say: It's easier for a malicious software engineer to embed a backdoor than the NSA, barr

I worked on the Echo firmware and cloud software. Let me definitively say: It's easier for a malicious software engineer to embed a backdoor than the NSA, barring any vulnerabilities in open source software (openssl, Linux, etc.). The "wakeword" is detected by a pretty large user space program, constantly observing filtered audio. The device can not recognize much on its own. The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice. The firmware and OTA process is likely more secure than necessary and it would be stupid difficult for a 3rd party to produce a signed firmware image, and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut. I would be (and am) much more concerned about my phone or laptop (or surroundings) recording me than the Echo devices. I am happy to talk more about the device security privately. I am sick at the amount of FUD around this class of products. There are so many more frightening threats out there. (Disclaimer: I used to, but no longer, work for Amazon.)

alsetmusic 10y ago
> It's easier for a malicious software engineer to embed a backdoor than the NSA, barring any vulnerabilities in open source software (openssl, Linux, etc.). Of course. An engineer within the company has access to source code without having to involve multiple parties. This does not preclude other threats or diminish the reach of a well-funded agency. Can an engineer at Google write code to log searches more easily than an outsider? Sure. That doesn't mean that you should write off the possibility that a third party could do the same.
geofft 10y ago
> The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice. This is probably the most compelling independently-verifiable argument. Even assuming the ability to do arbitrary things with an Echo, logging or transmitting useful voice all the time without notice isn't doable. And it seems hard to recognize suspicious discussions and turn on just for those (Echo has enough trouble recognizing "Alexa" 100% reliably). You could subvert Echo so that it records you during pre-determined times - but there are so many other devices you could subvert, too. Getting malware on a government official's personal laptop via spearphishing seems so much easier.
papaf 10y ago
The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice You can stream voice in 10kbps. When I was a kid I streamed voice using a Z80. CPU and bandwidth are not limiting factors. The fear isn't over what the Echo does in normal operation, it is what the Echo does when it has been compromised. It is nothing but a fancy remote controlled microphone sitting in your living room -- people used to write books about this to describe a dystopian future.
pmoriarty 10y ago
"The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice." What is the bandwidth required to stream speech? I remember reading back in the old days that speech only required 8k of bandwidth. Now with codecs that do efficient compression of speech, like Speex[1] and Opus[2], I expect that figure should be much improved. Are you really going to notice an 8k increase in your bandwith usage? [1] - https://www.speex.org/ https://www.speex.org/ [2] - http://opus-codec.org/ http://opus-codec.org/
digler999 10y ago
> easier for a malicious software engineer to embed a backdoor than the NSA, > and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut pretend I'm NSA. I show up to head counsel at AMZN with an NSL saying "all your code are belong to me". He says "yessa massa" and bows. I say, "ok, not all your code, but give me full disk images of the build server that signs code for the echo, and full disk images of the git server housing the current echo build. One "yessa massa" later, and he briefs CTO of DevOps to do the pull, which happens at 2:30am on a sunday morning (when those chatty-cathy engineers are fast asleep in their neckbeard nests). `cp disk1 disk2 /nsa_folder/` wait 20 minutes, done. NSA is doing full signed echo builds by EOD Monday. what is actually precluding that from happening. Now NSA can build "updates" for the echo, sign their builds, "deploy" them using their rooted telco infrastructure. what would actually keep this hypothetical scenario from happening ?

alsetmusic 10y ago

> It's easier for a malicious software engineer to embed a backdoor than the NSA, barring any vulnerabilities in open source software (openssl, Linux, etc.). Of course. An engineer within the company has access to source code without having to involve multiple parties. This does not preclude other threats or diminish the reach of a well-funded agency. Can an engineer at Google write code to log searches more easily than an outsider? Sure. That doesn't mean that you should write off the possibility that a third party could do the same.

geofft 10y ago

> The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice. This is probably the most compelling independently-verifiable argument. Even assuming the ability to do arbitrary things with an Echo, logging or transmitting useful voice all the time without notice isn't doable. And it seems hard to recognize suspicious discussions and turn on just for those (Echo has enough trouble recognizing "Alexa" 100% reliably). You could subvert Echo so that it records you during pre-determined times - but there are so many other devices you could subvert, too. Getting malware on a government official's personal laptop via spearphishing seems so much easier.

papaf 10y ago

The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice You can stream voice in 10kbps. When I was a kid I streamed voice using a Z80. CPU and bandwidth are not limiting factors. The fear isn't over what the Echo does in normal operation, it is what the Echo does when it has been compromised. It is nothing but a fancy remote controlled microphone sitting in your living room -- people used to write books about this to describe a dystopian future.

pmoriarty 10y ago

"The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice." What is the bandwidth required to stream speech? I remember reading back in the old days that speech only required 8k of bandwidth. Now with codecs that do efficient compression of speech, like Speex[1] and Opus[2], I expect that figure should be much improved. Are you really going to notice an 8k increase in your bandwith usage? [1] - https://www.speex.org/ https://www.speex.org/ [2] - http://opus-codec.org/ http://opus-codec.org/

digler999 10y ago

> easier for a malicious software engineer to embed a backdoor than the NSA, > and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut pretend I'm NSA. I show up to head counsel at AMZN with an NSL saying "all your code are belong to me". He says "yessa massa" and bows. I say, "ok, not all your code, but give me full disk images of the build server that signs code for the echo, and full disk images of the git server housing the current echo build. One "yessa massa" later, and he briefs CTO of DevOps to do the pull, which happens at 2:30am on a sunday morning (when those chatty-cathy engineers are fast asleep in their neckbeard nests). `cp disk1 disk2 /nsa_folder/` wait 20 minutes, done. NSA is doing full signed echo builds by EOD Monday. what is actually precluding that from happening. Now NSA can build "updates" for the echo, sign their builds, "deploy" them using their rooted telco infrastructure. what would actually keep this hypothetical scenario from happening ?