Researchers say they tricked Alexa into spying on them

Researchers at security firm Checkmarx say they built a proof-of-concept skill for Amazon’s Echo devices that in theory could have voice assistant Alexa listen to, transcribe, and report what users said after they thought they had finished using a legitimate service.

They took advantage of a feature that allows a skill to extend the time it listens to users after it’s been activated if it prompts them for more information by playing an inaudible prompt. That way, their skill, which offered a simple calculator, could keep getting transcripts from Alexa of what users said without them getting any audio cue that the device was still listening. A light would likely have been visible on affected devices, Threatpost reports, but users wouldn’t notice it unless they looked at the device.

Checkmarx never publicly released the skill, which would have required Amazon’s approval. And Amazon has since taken steps to safeguard against such software, including scanning for skills that silent prompts or that listen for unusual lengths of time, Wired reports.

“Customer trust is important to us and we take security and privacy seriously,” an Amazon spokesperson said in an email to Fast Company. “We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do.”

Last year, a separate group of researchers at China’s Zhejiang University said they had discovered how to play ultrasonic commands to voice assistants like Alexa and Apple’s Siri. The commands would be audible to the devices, though not humans (although humans would hear any audible responses from the devices).