Hackers have figured out how to turn an Amazon Echo into a live microphone. First reported by Wired, the attack requires physical access to the device, is limited to pre-2017 Echoes, and would be difficult to deploy at scale. But when successful, it would allow hackers to pull a live feed of all audio within range of the device, even if the wake word hasn’t been said. The method could also allow hackers to remotely retrieve authentication tokens and other sensitive data from the device.
Researcher Mark Barnes laid out the attack in a blog post earlier today. In simple terms, Barnes’ method compromises the device by booting from an inserted SD card — similar to a LiveCD — and uses that access to rewrite the Echo’s firmware. Once the...
