20 ms·
Amazon Echo Flex: Microphone mute button appears to be real and functional
- teruakohatu 6y agoTldr; it is real.
- markdown 6y agoThanks. Annoying that clickbait titles are allowed here.
- speedgoose 6y agoThe title gives all the information you need : https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline... If it was not a real mute, it would not be a question in the title but a statement such as "Amazon Echo Flex Teardown: The Microphone Mute is Fake".
- tolbish 6y ago> Like similar "laws" (e.g., Murphy's law), it is intended to be humorous rather than the literal truth.
- speedgoose 6y agoFor sure.
- jobigoud 6y agoThe title is not a yes/no question. You can't answer "is it real or fake?" by "no", the law doesn't apply and you have to take the bait to get the answer.
- speedgoose 6y agoYou got the point, if it was fake the title would very very likely be different.
- colejohnson66 6y agoThe rule is there not to prevent clickbait, but to prevent editorializing the title when it’s posted. The reason is editorializing inserts biases and possible wrongs (unintentionally). However, it is clickbait, by definition, but it’s not clickbait. If it was, I’d expect: “You’ll never guess what your Echo Flex does when you do this one thing!”
- coldtea 6y agoThe writers don't write for our amusement here and according to our criteria on HN, they writes as it pleases them. They went to the length to do a useful breakdown of a circuit, and write about it. They don't owe us some nice title, or some convenient summary so we don't read their post...
- renewiltord 6y agoHaha, they don't, but we owe ourselves that so we should submit with that info.
- bigiain 6y agoThat's not what the site guidelines say... "Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." Use the original titles.
- samatman 6y agoI would argue that the "Real or Fake?" part is clickbait-y, and the poster could have rewritten it to answer the question. This has come up before, and titles have been rewritten accordingly. Me? Title like that, I just skip to the comments, there's always someone at the top to sort me out.
- colejohnson66 6y agoNice to see electronupdate here. For those who don’t know, he also has a YouTube channel[0] where he does teardowns of random ICs. It’s quite interesting seeing the die shots. I’m assuming this post is a continuation of his “part 1” post/video from a week and a half ago[1] about the Echo Flex. His videos are definitely not scripted (and barely edited), which can be off putting to some (hearing “umm”s among other things), and he doesn’t go into the detail that Ken Shirriff (@kens) does, but they’re interesting nonetheless. [0]: https://youtube.com/c/electronupdate https://youtube.com/c/electronupdate [1]: https://youtu.be/gYPLunFMIEI https://youtu.be/gYPLunFMIEI
- exmadscientist 6y agoYou'd think that he'd be better at interpreting IC markings by now, though.... Part 1 is not "ICFJ", it's "CFJ". The line is the pin 1 marking. This one is the harder of the two; however, if you've been doing this a while, you'd recognize this SOT23-5 as coming from TI, whose online marking code lookup returns "SN74LVC1G14DCK" in just a few seconds. (Incidentally, that means the actual marking is "CF" with a lot/date code marker of "J"; the random-looking lines above and below the text are also a lot or date mark.) No acid needed! Part 2 isn't marked "COOR", it's "C00" with lot/date code "R". That's decodeable by eye as a TI LVC2G00 dual NAND gate. The third part, the one marked "JW", is probably an ON Semiconductor dual transistor, but those guys are always harder to track down. The fourth one, the SOT-323 (?) marked "39R"... that one will be hardest of all.
- moefh 6y agoYou seem to know what's going on, do you mind answering a question about the schematic? If the transistor is a PMOS like the author says, when the output of the NAND goes low wouldn't both the LED and the transistor turn on? The way the LED is drawn it should turn on when the NAND output is sinking current, right? Maybe the LED is drawn upside down? Or am I misreading/misunderstanding something really simple?
- exmadscientist 6y ago
- sircastor 6y agoThis is a really great breakdown of what’s going on in device. I really appreciate the case removal to look at the inside of the chips, as well as the general explanation of the circuits involved.
- jojobas 6y agoThe implication is that the microphone emits completely no signal without power and doesn't have any capacitor to last even a few seconds. Surely the most valuable data is just after the mute is turned on?
- mlyle 6y agoThere's no massive electrolytic capacitor that would be needed to power it for a few seconds. It's gonna be pretty damn fast. Standard ceramic decoupling cap-- very likely 0.1uF-- right next to it. 1/2 C V^2 at 3.3V is 0.5 microjoules. If the entire energy in the capacitor can go to effectively power the microphone (it can't), and the typical power consumption of a MEMS microphone is about 1 milliwatt, it might keep working for about 500 microseconds.
- kevin_thibedeau 6y agoThe parallel flops are probably hardening against bit flips from ESD events. There aren't any other active protection devices and phantom flips probably showed up at some point during testing of earlier prototypes.
- spicybright 6y agoI'm honestly surprised they went that far, and happy they did.
- faeyanpiraat 6y agoI think accidental unmuting due to random events would translate into “theyare listening to me” in their average customer’s mind, and would be a pr disaster. Compare the cost of that to an extra component, and the surprise goes away.
- sokoloff 6y agoThere’s no “extra component” in the physical design. Both flip-flops are in the single 74x74 package and if you’re only using one, you have to drive the other to a known state anyway, so why not use them both anyway?
- faeyanpiraat 6y agoEven better
- colejohnson66 6y agoMaybe because they had a second flip-flop and CMOS is sensitive to floating inputs? So they just decided to use both in parallel? Just a guess.
- deleted 6y ago[deleted]
- osamagirl69 6y agoVery nice writeup, I love the combination of fun writing style and hand drawn schematics with things quickly escalating to decapping chips. Also nice to see that the led is a real one, even if the micro does have the ability to override the mute switch... I guess the 80's scifi movies with red glowing eyes to indicate the 'evil' subroutene was activated got it pretty close!
- mlyle 6y agoHere, the red glowing eye turns off when the evil subroutine is activated.
- pengaru 6y agoSo the microphone signal line isn't broken by the mute, got it.
- mlyle 6y agoNo-- even better, the MEMS microphone is depowered.
- bigiain 6y agoNot sure that really qualifies as "even better"... "Even better, there is no microphone", is about the only "even better" scenario than the signal lines being broken. A powered down active component is only "almost as good" at best.
- mlyle 6y agoOK, so you'd rather have a big, high gain, low output impedance amplifier enabled and driven with the audio waveform but the signal line gated... than the device unpowered and the signal line connected to ground via the ESD protection path in the package. K. I'd have a decent chance at recovering the audio in the former case, but nil in the latter.. For instance, if it's gated with a FET, and then hooked up to a SOC ADC pin that's multiplexed with other functions, one could use those other functions to provide biasing opening the FET. If it's gated with something better-- e.g. an actual relay-- the audio waveform may still be recoverable: it's very, very large in magnitude compared to how it is with the device unpowered, and will be consuming variable amounts of power with the audio waveform. You might be able to recover the signal by measuring power nets AC coupled with lots of gain.
- pengaru 6y agoI wasn't aware the two were mutually exclusive. Why wouldn't you cut the power AND the signal? That MEMS microphone is producing analog output, is it not? I did a cursory search for the printed part numbers but came up empty handed.
- chaboud 6y agoDisclosure: I'm an Amazon Devices PE, but not on Alexa devices. Jeff (and others) have spoken publicly about this in the past, and this teardown is correct. The hardware is designed such that, if the privacy LED is on, the microphone is unpowered. In order to compromise that, one would need to physically alter/damage the hardware.
- e9 6y agoWhy not physical debounce switch? I get it is more expensive but no one would question it twice.
- texasbigdata 6y agoWhat’s wrong with their solution / implemention? Why do they have to defend against a tear down?
- systemvoltage 6y agoIn order to use a physical debounce switch, there are several steep challenges. You can imagine OP presenting to an audience of 14 people at Amazon Devices group with a slide titled "New BOM proposal" entailing 6 million devices x [$0.0273 (switch price at 100k qty) + $0.05 assembly cost] + $50k engineering NRE (650 engineering hours) + $35k tooling NRE + $22k FCC re-cert + 7k ESD cert + another $100k in various certifications from continental EU, JP, Australia, UK and Brazil. At the end, OP has to say "We love our customers, don't we?" followed by an awkward silence. RIP OP.
- Prcmaker 6y agoColour me impressed! I would have expected a digital pin be used to control the microphone in software, which I wouldn't have been nearly as satisfied to see. Really nicely presented breakdown too.
- mlyle 6y ago> Colour me impressed! I would have expected a digital pin be used to control the microphone in software Yup, and even if the same pin drives both the LED and the microphone power switch, there's various attacks (e.g. high frequency PWM 75% duty cycle-- enough to light the LED to nearly full brightness, but also probably enough to keep the mic bypass capacitor nearly fully charged). Since the SOC can only turn off mute, and not turn it back on, any attempt to eavesdrop would leave evidence (a mute LED left off).
- jessriedel 6y agoConclusion: > But, basically if one presses the switch it causes the flip-flops to change state and to then either add or remove power from the microphones. > The 'mute' button appears to be very real and functional. When the button glows 'red' the power is removed from the microphones.
- pansa2 6y agoI sometimes write articles describing investigations similar to this one. Do you think this article’s structure is appropriate? Or would it be better to reduce the need for comments like this one by putting the conclusion much earlier in the piece? I understand not putting the conclusion in the title, but perhaps in the first paragraph, in the spirit of BLUF [0]? [0] https://en.wikipedia.org/wiki/BLUF_(communication) https://en.wikipedia.org/wiki/BLUF_(communication)
- Birkalo 6y agoI think that BLUF is definitely the better way of writing most informational pieces, particularly articles such as this. It's a similar concept to the 'Topic Sentence' which would be used to sum up the ideas of the following paragraph. The only reason I could see for actively choosing not to use BLUF - would be to force users to read more of your article for the sake of it, which seems (to me) like a 'cheap' tactic.
- pansa2 6y agoDo you think presenting the conclusion up-front could detract from the “story-telling” of the piece? By walking the reader through the investigation and its findings in chronological order, perhaps the article aims to make the reader feel like they are performing the investigation themselves?
- tomxor 6y agoAgreed. Although being upfront to some degree is useful there is a balance, some things are better revealed in context to fully appreciate. If the conclusion is less binary or singular something can be sacrificed without ruining everything, but in this case I can't see a way to not destroy the story telling... I'm pretty sure I preferred reading this without BLUF.
- bonoboTP 6y agoRed light used to indicate recording, traditionally. I'd expect the light to be green when I'm safe from spying.
- deleted 6y ago[deleted]
- CamperBob2 6y agoNot sure why this was voted down, as that's the way I'd expect it to work as well. The red light should flash or pulsate when recording, in fact. Otherwise, people without good color vision might miss the cue.
- deleted 6y ago[deleted]
- jodrellblank 6y agoThe parent comment is a "hurr de hurr it should be green when I'm PROTECTED from SPYING" comment. From the point of view of a normal person who bought it for the Alexa functions, is GREEN for "stop" and RED for "go" honestly the way round you'd expect it to work?
- magicalhippo 6y agoWhile a multi-color LED would be preferable, if only a single LED could be spared then it's better that it's on to indicate mic is off. Otherwise the LED could fail and you wouldn't be able to tell if the mic was on. As is, you assume the mic is on if the LED fails, which is preferable from a privacy point of view.
- plumeria 6y agoMy 2015 Macbook turns on a green LED when the camera is recording.
- jannes 6y agoAgreed. The red LED seems to be a conscious choice to indicate something that you need to get rid of (like those notification badges on iOS app icons or the unread indicator on Facebook). This is especially jarring as the rest of Alexa LEDs are all blue.
- meehatpa 6y agoAll cameras should also have this.
- bayindirh 6y agoIIRC Apple hardwires camera LED to enable pin for some time now. You can't even disable the LED even if you tamper with the camera firmware. Old Logitech Pro 9000 is the exact opposite. You can control the LED independently of the camera state.
- shaicoleman 6y agoSame with the Logitech Brio. You can turn off the LED while recording.
- ncmncm 6y agoWe have been over this before: if you want to take surreptitious images on Apple, you operate the camera at a low enough duty cycle that it doesn't look like it's on. It could have been wired to indicate recording for a minimum of a second after each image capture. But it wasn't.
- bobuk 6y agoBut there’s still a security flaw in this method. If somebody from Amazon will decide to record you, they just send a reboot command to Echo. After reboot mic’s state will be changed back to normal I.e. powered.
- harrisonjackson 6y agoIn that scenario, couldn't they just send an unmute command?
- 867-5309 6y agoin the same vein, what about the overlooked 1mm x 1mm chip that holds logic such as {{ if red_led==active then pushAudio('udp://amazon.com/jeffsBathroomSpeaker') }}
- dmix 6y agoConsidering the countless chips on most standard SoCs this is the correct answer. And presumably what the NSA does when they reroute your Dell or MacBook for an overnight session in a sealed off room at the post office. Doesn’t even need to be at Amazon’s factory in China of where ever. But that is largely feasible too. The difficulty is more about data exfiltration. Has to be appended to some real ‘normal’ request the next time a legitimate use of the mic is made, then piggybacks uploads on that connection. Recording all times when a voice is heard would also massively increase the payload sent to the server. If you were just passively network monitoring it could stick out. Which is not something nation states want. Forget these smart home mics, if I was a nation state I’d just stick with the mobile phones and laptops every person uses. People are already paranoid about their Alexas inherently (and far more likely to potentially care to look) making them a poor target for hacking. It’s far more useful to turn the thing they carry around with them 24/7 into an active microphone with GPS, and plenty of more exfiltration possibilities with any mobile and desktop OS network traffic.
- mlyle 6y agoUnless it has a microphone itself, that's difficult, because the actual microphone is depowered.
- tangoalpha 6y agoAn OTA firmware update can change this behavior overnight. Unless it's a physical bounce switch that actually disconnects power mechanically, you are still at the mercy of someone else.
- bayindirh 6y agoAs far as I understood from the schematic [0], the power line of the mic is directly connected to the LED. Looks like when you press the mute button, you both light the led up and pull-up the transistor gate (It looks like PNP so, it turns off when you apply power to the gate). This effectively cuts off power from the mic itself. So, the LED is not controlled by firmware but, by the behavior of the circuit. AFAIK, OTA updates cannot re-wire PCBs or do we have nanobots now? [0]: https://1.bp.blogspot.com/-vVhoXpEtTXo/X_0iLmz9gcI/AAAAAAAABj8/9DALUKd4IwkluhLphXtsK8g_sHitWxQzgCLcBGAsYHQ/w400-h243/DSCN3085.JPG https://1.bp.blogspot.com/-vVhoXpEtTXo/X_0iLmz9gcI/AAAAAAAAB...
- bibabaloo 6y agoPerhaps you could disable the button, but I don't think a firmware update can change the red LED on == microphone off behaviour. This is a good compromise IMO, as if the microphone off button stops working then you can deduce that the firmware may have been tampered with.
- detaro 6y agoHow does a firmware update change the hardware on the board?
- bigiain 6y agoAs I understand the teardown article, it is impossible for a firmware update or any malicious SOC code to enable the microphone without also turning the red led off. Not as good as a physical switch I guess, but better than some implementations of laptop webcam activity lights at least...
- ohazi 6y ago> Unless it's a physical bounce switch that actually disconnects power mechanically That's literally what you're looking at. The schmitt-trigger and the DFFs debounce the switch in hardware, and then the FET that controls the power input to the microphone also controls the power input to the LED. What do you want, a relay? Firmware can only reset the DFFs (which does turn on the microphone), but it can't change the physically coupled LED / mic-power behavior.
- electro_blah 6y agoThat's great. now find the other hidden mic disguised as a different component.
- deleted 6y ago[deleted]
- Krasnol 6y agoThere has been a related "talk" on rc3 on the topic, featuring scientists who analysed the traffic: https://media.ccc.de/v/rc3-466940-alexa_who_else_is_listening https://media.ccc.de/v/rc3-466940-alexa_who_else_is_listenin...
- sdfaeagaca342 6y agoI'm also worried about echo devices scanning my home network
- maigret 6y agoThen don't buy one.
- PeterStuer 6y agoWith Alexa and it's ilk being integrated in ever more home electronic devices, not buying one is becoming increasingly impossible.
- mvanbaak 6y agoPut them on their own network, make sure that network is not routed/connected with the internet. Or, if possible, dont connect to a network at all.
- PeterStuer 6y agoThere is ISP provided 'free roaming' wireless internet access nearly everywhere here. Very hard to block devices that really want and have deals with ISP's from accessing the internet even if your own network is secured.
- nisa 6y agosed -i 's/impossible/inconvenient/g' The power of convenience is probably also the reason to place a megacorp microphone in your home in the first place.
- PeterStuer 6y agoFinding out whether an 'assistant' is present is not always straightforward form the product information before you buy.
- HourglassFR 6y agoYes that is the technical conclusion. But maybe the most important thing is that we have to do an actual teardown of the product in order to have some confidence that Amazon is not lying on it's Echo capabilities. To be clear, I am not saying we should trust Amazon & Co, I'm saying that if that's the level of trust we have with home assistance devices, why even bother with the stuff ?
- blackoil 6y agoWe have options of either to trust the company or some other auditor. We can try getting some laws made to ensure honesty, but I personally don't like that route this early in the technology. What we need a completely independent organisation like EFF to audit and certify basic guarantees around privacy/safety. The companies should also prefer this route as it would give take some heat off in EU/Congress without creating bureaucratic bottlenecks. One problem I see that such an organisation can act as front for the cartel to prevent entry of new startups/players.
- jstanley 6y ago> We can try getting some laws made to ensure honesty I'm pretty sure we already have laws to ensure honest advertising. The problem is that it's hard to tell the difference between malice and incompetence.
- Daho0n 6y agoThat would make EFF a de facto certifier, taking on the role of state and make it a (bigger) target for big business. Really, we need laws (and a system that isn't broken. More like in Scandinavia, less like the Federal Communications Commission).
- mhb 6y agoIsn't this Consumer Reports?
- KraftKacke 6y agoTo me it's unfathomable to have such a device around. I even feel uncomfortable with my neighbor having one (which I _hear him talking to). I assume it's like reading the side effects of medication and think they are other people's problems somehow. How do people trade core privacy for setting the alarm or getting the weather report by voice command. I don't respect them. Same with off the shelf IP cameras in one's bedroom. Hello? Air gapped speech recognition and FOSS, or this should never, ever become a thing.
- aufhebung 6y agoDon't these mute buttons defeat the purpose of these devices in the first place? If I want to do what generally amounts to a google search it's generally easier to pull out my phone than walk over to the device, flip a switch, and speak.
- jstanley 6y agoTo wear a tinfoil hat for a moment: > The SOC (system on chip) controller seems to be connected to the flip flop resets > The 'mute' button appears to be very real and functional. When the button glows 'red' the power is removed from the microphones. Does the microphone take any time to boot up? How far could a malicious SoC get by toggling "reset" on and off very fast? If you toggle the microphone on and off at 96kHz with e.g. a 1% duty cycle, then you'd be able to sample the level from the microphone at 96kHz, and the LED would still be glowing at 99% of its usual current (which would be visually indistinguishable from 100%). This would allow the SoC to record audio at full quality, and still leave the LED glowing.
- _flux 6y agoSo I picked the very first mems microphone datasheet my ddg gave me: https://www.st.com/resource/en/datasheet/mp34dt06j.pdf https://www.st.com/resource/en/datasheet/mp34dt06j.pdf ..and it says 10 ms max turn on time, so 100 Hz. Of course, a typical or minimum turn on time could be better, but I imagine it it were better, it would be advertised as well.
- danhor 6y agoThe reset stays. If the soc toggles the reset line, the microphone stays on and the led turns off, until the user presses the mute button
- jeffrallen 6y agoThe fact that the mike defaults to on after power on is completely understandable from a user interface perspective, but from a security perspective it makes the mute switch useless. Why? Because any attacker that has penetrated far enough to be able to control the SOC in order to snoop can also trigger a SOC reset in order to make sure that the mike is enabled before they start snooping. A physical switch would have been a better choice, if it was actually for security instead of security theatre.
- dvfjsdhgfv 6y ago> The fact that the mike defaults to on after power on is completely understandable from a user interface perspective A compromise would be to play a message after turning the device on, requiring user to take action and unmute it or leave muted. This shouldn't be a problem in most scenarios as Echo is meant to be powered once and run for a long time, so it would be just a minor inconvenience.
- kylegordon 6y agoI'm curious as to what the state would be after a firmware upgrade?
- lemonspat 6y ago> would be to play a message after turning the device on It does this already
- jstanley 6y agoAt least it sounds like the red light would go out in this case, so you'd have some indication that something is up.
- cyphar 6y agoThat assumes you check whether the mute light is active on a fairly regular basis. If you just turn it off and don't check on it, the light is pretty much useless as an indicator.
- fctorial 6y agoNow we just need another person educated enough to verify this blogpost.
- torgian 6y agoInteresting read. But if I owned one, I would destroy the trace going to the mic, specifically the one giving power, and install my own physical switch as a physical power switch.
- cbradford 6y agoAnyone that invited one of these spying devices into their home gets what they deserve.
- jwr 6y agoThat's an excellent teardown! Thanks! I think we should appreciate that while this isn't the best or most secure design (I'm not that happy with the host controlling the reset), it at least has an LED that shows the microphone status, which can't be controlled by software. I think this is the very bare minimum we should require from all our digital devices.
- Geminidog 6y agoDid you really have to acid etch a chip package to find this out? Can’t you measure current/voltage across the microphone?
- monsieurbanana 6y agoThe reverse engineering work here showed that "LED is electrically tied to the signal which controls the microphone's power", which means there's no software way to turn the microphone on while keeping the LED red. Measuring the current of the microphone would only tell us that at a specific moment, the microphone is off and the LED is red. But that might be a software switch, in which case nothing would prevent Amazon to turn the microphone from time to time while keeping the LED red.
- njdullea 6y agoWhat did the OP do with acid to get an image of what was in the ICFJ chip?
- jaywalk 6y agohttps://en.wikipedia.org/wiki/Decapping https://en.wikipedia.org/wiki/Decapping
- WClayFerguson 6y agoIt's likely there are microphones in Echo that even an electronics expert can't "recognize" as a microphone. Any object that is flimsy and can 'vibrate' due to sound, can have it's position used to alter an electrical signal, and anything monitoring that signal can convert the signal easily back into sound. Even a non-data carrying wire with current can do this.
- parsecs 6y agoI don't know about that. Yeah, ceramic capacitors in particular exhibit strong piezoelectric effects, but you'd need some sort of silicon to amplify the signal. I think electronic experts should be able to discover any sketchiness like that through thorough inspection and reverse engineering.
- WClayFerguson 6y agoI'm a mechanical engineer myself. I've built microphones before in a college laboratory where all we used (proved) was "any object that vibrates from sound, which can be used to alter an electrical current, can be turned back into sound" Even the most basic form of digital audio stored as PCM (redbook, etc) is actually nothing but a file where every data-point in the file is an integer representing the 'magnitude' of a disturbance during that short milli/microsecond of time. Any vibrating 'disturbance' is the very definition of "sound" itself too.
- parsecs 6y agoI'd consider myself an electrical engineer. How do you suppose you would transform and capture those vibrations to electrical signals with enough fidelity? I'm aware of techniques like perhaps laser diode self mixing. How will you do it in a way that cannot be detected even by experts? What I'm getting at is: how do you capture those signals without the use of obvious silicon devices (so no MEMS or opamps or whatever)? I'd imagine you have to hide it in software somehow. Then how do you acquire that signal? A simple analog input pin to the ADC of a cheap microcontroller is not good enough.
- antattack 6y agoI had amazon flex muted (top and button lights red) then red light up-top started to pulsate blue. I unmuted the flex by pressing the mute button to see if I had notifications. Flex did not respond but mute button become red again in a few seconds. TLDR, it appears that mute function can turn itself on by itself.
- sunds 6y agoI wonder why they needed two flip-flops. Wouldn't one suffice and eliminate the NAND gate? Could the feedback from the transistor be used to debounce via the data line as well?