CVE-2018-11567

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still...

Design/Logic Flaw

DISPUTED Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the us...

CVE-2018-11567

The CVE concerns Amazon Echo devices where the reprompt feature can be misused by a malicious Alexa skill. Affected component: reprompt handling within Echo devices (prior to 2018-04-27). Root cause: empty output-speech reprompts, wildcard input slots, and logging of detected speech enable an att...

CVE-2018-11567

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still...

Researchers discover vulnerabilities in smart assistants’ voice commands

Virtual personal assistants VPA, also known as smart assistants like Amazon’s Alexa and Google’s Assistant, are in the spotlight for vulnerabilities to attack. Take, for example, that incident about an Oregon couple’s Echo smart speaker inadvertently recording their conversation and sending it to...

PT-2018-10673 · Amazon · Alexa +1

Name of the Vulnerable Software and Affected Versions: Amazon Echo devices affected versions not specified Description: The reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill, allowing an attacker to obtain transcripts of speech not intended for Alexa to process. Thi...

A week in security (May 21 – May 27)

Last week we told you about a Mac cryptominer using XMRig, an overview of Dreamcast related scams, part 1 of decoding Emotet, and what to do about bad coding habits that die hard. We also published the results of our second CrackMe contest. Other news How a pioneer of machine learning became one ...

Alexa Eavesdropping Flub Re-Sparks Voice Assistant Privacy Debate

After an Alexa-enabled Echo device recorded and shared a private conversation of its unknowing owners, the tech industry – and the public – is casting a wary eye on voice assistant privacy issues. On Thursday, news emerged that a Portland family’s Echo device had recorded a conversation of them –...

Amazon Alexa Has Got Some Serious Skills—Spying On Users!

"Alexa, are you spying on me?" — aaaa.....mmmm.....hmmm.....maybe!!! Security researchers have developed a new malicious 'skill' for Amazon's popular voice assistant Alexa that can turn your Amazon Echo into a full-fledged spying device. Amazon Echo is an always-listening voice-activated smart ho...

Amazon Alexa Has Got Some Serious Skills—Spying On Users!

"Alexa, are you spying on me?" — aaaa.....mmmm.....hmmm.....maybe!!! Security researchers have developed a new malicious 'skill' for Amazon's popular voice assistant Alexa that can turn your Amazon Echo into a full-fledged spying device. Amazon Echo is an always-listening voice-activated smart ho...

Researchers Hacked Amazon’s Alexa to Spy On Users, Again

A malicious proof-of-concept Amazon Echo Skill shows how attackers can abuse the Alexa virtual assistant to eavesdrop on consumers with smart devices – and automatically transcribe every word said. Checkmarx researchers told Threatpost that they created a proof-of-concept Alexa Skill that abuses...

Gone Phishing For The Holidays

Written by Or Katz and Amiram Cohen Overview: While our team, Akamai's Enterprise Threat Protector Security Research Team, monitored internet traffic throughout the 2017 holiday season, we spotted a wide-spread phishing campaign targeting users through an advertising tactic. During the six week...

unishop.by XSS vulnerability

Vulnerable URL: https://unishop.by/search/?query=%3C/title%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 137256 VIP website status:| No Coordinated Disclosure Timeline:...

planetkey.de XSS vulnerability

Vulnerable URL: https://www.planetkey.de/suche/?s=%22%2F%3E%27%3E%22%3EI%3Ci%3EI%3Csvg%2Fonload%3Dalert%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 112859 VIP website status:| No...

qmery.com XSS vulnerability

Vulnerable URL: http://qmery.com/?s=" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 216938 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bu...

axiomtelecom.com XSS vulnerability

Vulnerable URL: https://www.axiomtelecom.com/search/'%3E%3Csvg/onload=alert'OPENBUGBOUNTY.ORG'%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 53431 VIP website status:| No Coordinated Disclosure Timeline:...

tpd.sk XSS vulnerability

Vulnerable URL: https://www.tpd.sk/elektronika-a-spotrebice-c20073?page=2%22%3E%3Cimg%20src=1%20onerror=alert%22OPENBUGBOUNTY%22%3E.gif Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 98297 VIP website status:| N...

humo-gen.com XSS vulnerability

Vulnerable URL: http://www.humo-gen.com/humo-gen/birthdaylist.php/a7210%22%3E%3Cimg%20src%3da%20onerror%3dalert1%3E9ebde7bc1a6 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4650102 VIP website status:| No...

pizza.od.ua XSS vulnerability

Vulnerable URL:...

media.info XSS vulnerability

Vulnerable URL: https://media.info/search?s=%3C/script%3E%3Csvg%2Fonload=confirm%2FOPENBUGBOUNTY%2F%3E Details: Description| Value ---|--- Patched:| Yes, at 20.12.2017 Latest check for patch:| 20.12.2017 06:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2465...