3 ms·

Nobody has EVER gotten root console access on an Echo device remotely, and the only successful "remote" exploit that didn't require soldering requires that the

Nobody has EVER gotten root console access on an Echo device remotely, and the only successful "remote" exploit that didn't require soldering requires that the attacker and the victim are both on the same wifi network. Please, feel free to explain how Amazon and Google could exploit that vulnerability (that has since been patched)? More importantly, I'd love to hear how they are going to pull this off and hide it, given network traffic will be a dead give away? If what your suggesting is actually what he meant, that's even more absurd than attackers trying to do the same.

XMPPwocky 8y ago
I'm quite confident Amazon has remote root on every Echo device. It's called a firmware update.
- jhall1468 8y ago
  True enough. They could easily push a new update that would record every single thing you say, and despite not indicating anywhere on the device, it would take a matter of minutes before it was in the news because what they certainly can't do is hide network traffic.
  - XMPPwocky 8y ago
    Right, the bigger concern for me is targeted attacks. One user, especially a non-technical user, getting a "special" update pushed out.
dogecoinbase 8y ago
As indicated in your previous comments, e.g. https://news.ycombinator.com/item?id=18616219 https://news.ycombinator.com/item?id=18616219 , you work for Amazon. It would be a better look if you disclosed this openly when commenting about Amazon.
- jhall1468 8y ago
  It's easily located in my post history, however, I don't work with anything even remotely related to the Echo devices. My interest in this discussion is as a user, not as an employee.
  - heavyset_go 8y ago
    It's an ethics issue. You have vested interest in Amazon's public perception as an employee. You can't try to divorce your comments from your relationship with Amazon and expect to still be taken seriously. A simple disclosure would have lent your comments more credibility.

XMPPwocky 8y ago

I'm quite confident Amazon has remote root on every Echo device. It's called a firmware update.

jhall1468 8y ago
True enough. They could easily push a new update that would record every single thing you say, and despite not indicating anywhere on the device, it would take a matter of minutes before it was in the news because what they certainly can't do is hide network traffic.
- XMPPwocky 8y ago
  Right, the bigger concern for me is targeted attacks. One user, especially a non-technical user, getting a "special" update pushed out.

dogecoinbase 8y ago

As indicated in your previous comments, e.g. https://news.ycombinator.com/item?id=18616219 https://news.ycombinator.com/item?id=18616219 , you work for Amazon. It would be a better look if you disclosed this openly when commenting about Amazon.

jhall1468 8y ago
It's easily located in my post history, however, I don't work with anything even remotely related to the Echo devices. My interest in this discussion is as a user, not as an employee.
- heavyset_go 8y ago
  It's an ethics issue. You have vested interest in Amazon's public perception as an employee. You can't try to divorce your comments from your relationship with Amazon and expect to still be taken seriously. A simple disclosure would have lent your comments more credibility.