20 Million Google Home and Amazon Echo devices are affected by the Blueborne flaws

Pierluigi Paganini November 17, 2017

Millions of AI-based voice-activated personal assistants, including Google Home and Amazon Echo, are affected by the Blueborne flaws.

A series of recently disclosed critical Bluetooth flaws that affect billions of Android, iOS, Windows and Linux devices have now been discovered in
Millions of AI-based voice-activated personal assistants, including Google Home and Amazon Echo, are affected by the recently discovered Blueborne vulnerabilities.
The recently discovered BlueBorne attack technique was devised by experts with Armis Labs. Researchers discovered a total of eight vulnerabilities in the Bluetooth design that expose devices to cyber attacks.
Billions of mobile, desktop and IoT devices that use Bluetooth may be exposed to a new remote attack, even without any user interaction and pairing. The unique condition for BlueBorne attacks is that targeted devices must have Bluetooth enabled.
blueborne attack

Once an attacker compromises a Bluetooth-enabled device, he can infect any other device on the same network.

The IoT security firm Armis now reported that an estimated 15 million Amazon Echo and 5 million Google Home devices are vulnerable to BlueBorne attack.

“Following the disclosure of the BlueBorne attack vector this past September, Armis discovered that critical Bluetooth vulnerabilities impact the Amazon Echo and Google Home. These new IoT voice-activated Personal Assistants join the extensive list of affected devices.” reads the blog post published by Armis.

“Personal Assistants are rapidly expanding throughout the home and workplace, with an estimated 15 million Amazon Echo and 5 million Google Home devices sold. Since these devices are unmanaged and closed sourced, users are unaware of the fact their Bluetooth implementation is based on potentially vulnerable code borrowed from Linux and Android.”

The Amazon Echo devices are affected by the following two vulnerabilities:
  • Remote code execution vulnerability in the Linux Kernel (CVE-2017-1000251)
  • Information leak vulnerability in the SDP Server (CVE-2017-1000250)

The researchers highlighted that other Echo devices running Linux or Android operating systems are affected by other Blueborne vulnerabilities.

Google Home devices are affected only by the CVE-2017-0785 vulnerability that is an information disclosure flaw in Android’s Bluetooth stack.

The voice-activated personal assistants are constantly listening to Bluetooth communications, an attacker within the range of the vulnerable IoT device can easily hack them.

“These devices are constantly listening to Bluetooth communications. There is no way to put an agent/antivirus on these devices. And given their limited UI, there is no way to turn their Bluetooth off” continues the blog post.

Experts from Armis published a video proof-of-concept (PoC) to show how to hack an Amazon Echo device.

Armis reported the issues to both Amazon and Google that have released patches and issued automatic updates for the affected problems.

Amazon Echo users can check that their devices are using a version that is newer than v591448720.

“The Amazon Echo and Google Home are the better examples as they were patched, and did not need user interaction to update. However, the vast bulk of IoT devices cannot be updated. However, even the Echos and the Homes will eventually be replaced by new hardware versions (as Amazon and Google recently announced), and eventually the old generations will not receive updates – potentially leaving  them susceptible to attacks indefinitely.” concluded Armis.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Bluetooth hacking, BlueBorne attack)

[adrotate banner=”5″]

[adrotate banner=”13″]



you might also like

leave a comment