Security considerations for voice-activated digital assistants - ITSAP.70.013

On this page

• How voice-activated digital assistants work
• Risks associated with digital assistants
• Attack methods
• Considerations for selecting a vendor
• Securing your digital assistant
• Steps to address a compromise

How voice-activated digital assistants work

Voice-activated digital assistants come in various forms, such as smart speakers, smartwatches and smartphone applications. These devices respond to human commands through voice recognition technology. They record and listen for commands or trigger words. Once triggered, the device captures the request and searches the Internet for a suitable response or carries out the requested action. These devices also listen and parse conversation for the purposes of targeted marketing.

Voice-activated digital assistants use algorithms and machine learning to improve their performance over time. They create user profiles to identify individuals who issue commands, allowing for more personalized interactions. This involves saving voice recognition data and storing information about the resources and smart devices they use to fulfill your requests. For example, digital assistants may retain data such as websites visited and settings for controlling your home appliances or security cameras. Although digital assistants can create profiles to recognize voice commands from a particular individual, they will record and respond to any voice command they can interpret.

Risks associated with digital assistants

Voice-activated digital assistants are high-value targets for cyber threat Cyber threatA threat actor, using the internet, who takes advantage of a known vulnerability in a product for the purposes of exploiting a network and the information the network carries. actors who want to steal sensitive information. The interconnected nature of these devices means that a vulnerability VulnerabilityA flaw or weakness in the design or implementation of an information system or its environment that could be exploited to adversely affect an organization's assets or operations. in one digital assistant or a device connected to it can compromise CompromiseThe intentional or unintentional disclosure of information, which adversely impacts its confidentiality, integrity, or availability. the security of the entire network.

Cyber threat actors can take advantage of these vulnerabilities in various ways, including:

• accessing personal information, such as
  • usernames
  • passwords
  • other sensitive account details
• learning whether you are at home or away
• tampering with other connected smart device controls to compromise security and integrity, such as
  • adjusting temperature settings
  • unlocking doors
  • disabling alarms

There are also additional risks tied to some of the features of digital assistants.

Storing voice recognition recordings and transcripts

Devices can retain a voice-to-text transcription when the device sends a recorded voice command to a cloud-based resource. This data could contain confidential information, particularly if the voice service was triggered accidentally. Be aware of vendors' privacy policies. Vendors often have terms that allow them to retain recordings or transcriptions for quality improvement or to share with partners.

Eavesdropping on sensitive conversations

Voice commands for activities like controlling lights or changing music have a minimal risk of capturing background conversation. However, there are other scenarios where captured background conversations can be risky. For example, connecting a voice assistant to a business platform to dictate the content of your emails could give it access to sensitive conversations. Threat actors can leverage this data to conduct dolphin attacks or make unauthorized purchases. You should turn on confirmation dialogs to minimize the risk of accidental or unauthorized transactions. This will prompt your device to repeat your command and confirm that you want to proceed. Modern devices that have on-device voice recognition can be safer.

Attack methods

Cyber threat actors could target your digital assistant through methods such as a "dolphin" attack or malware MalwareMalicious software designed to infiltrate or damage a computer system, without the owner's consent. Common forms of malware include computer viruses, worms, Trojans, spyware, and adware. .

"Dolphin" attack

A "dolphin" attack broadcasts ultrasonic frequency sounds which are inaudible to the human ear but trigger the recording feature in digital assistants. These high-frequency sounds can be embedded into videos, websites or even physical devices enabling threat actors to target digital assistants within range. By emitting these sounds, threat actors can trigger the digital assistant to initiate actions, such as transferring files, making unauthorized purchases and stealing sensitive data.

Malware

Malware is a common method used by cybercriminals to compromise digital assistants. It infects these devices through disguised applications, malicious attachments and links. Malware is very hard to detect and diagnose on digital assistants. Once inside, threat actors can use malware to record your voice and use the recording for other malicious activities, such as bypassing voice recognition authentication AuthenticationA process or measure used to verify a users identity. on your other devices.