Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Alexa and Google Are Listening: How Much Are They Transmitting

Alexa and Google Are Listening: How Much Are They Transmitting

Presentation from BSidesIowa and BSidesKC 2018

Aaron Blythe

April 21, 2018
Tweet

More Decks by Aaron Blythe

Other Decks in Technology

Transcript

  1. ALEXA AND GOOGLE ARE LISTENING how much are they transmitting?

  2. @ablythe DEMO

  3. @ablythe RECORDING HTTPS://YOUTU.BE/OFPGL5Z5DFQ

  4. @ablythe https://www.youtube.com/watch?v=vmINGWsyWX0

  5. @ablythe

  6. @ablythe

  7. @ablythe

  8. @ablythe

  9. @ablythe

  10. @ablythe

  11. @ablythe

  12. @ablythe Aaron Blythe (aaronblythe.com) • Lead Organizer • @devopskc @devopsdayskc

    sizzle.devopsdayskc.org
  13. @ablythe https://youtu.be/r8wl5dcWg5w

  14. @ablythe Assistant/Device Cost Test Result Siri/iPhone Too Much/ Have to

    have What sound does a pig make? Alexa/Echo Dot $49.95 ($29.95 Black Friday) What does a pig say? I’m sorry. I only know English at the moment, I’ll try and learn some animal languages Hey Google/ Google Home $49.00 ($29.99 Black Friday) What sound does a pig make? What does a pig say?
  15. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  16. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  17. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  18. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT TRAFFIC IS LEAVING MY HOUSE?
  19. AMAZON ECHO DOT @ablythe

  20. @ablythe

  21. @ablythe

  22. @ablythe DOMAINS • api.amazon.com • api.amazonalexa.com • *.amazon.com • *.amazonaws.com

    • *.pandora.com • *.spotify.com • *.amazoncrl.com
  23. @ablythe

  24. @ablythe

  25. @ablythe DOMAINS • *.cloudfront.com • clients3.google.com • *.amcs-tachyon.com

  26. @ablythe

  27. @ablythe DOMAINS • *.cloudfront.com —> Needs authentication - Amazon CDN

    • clients3.google.com —> ??? • *.amcs-tachyon.com —> Registered to Amazon
  28. GOOGLE HOME MINI

  29. @ablythe

  30. @ablythe DOMAINS • *.google.com • *.googleapis.com • *.googleanalytics.com • *.googleusercontent.com

    • *.gstatic.com —> Registered to Google • pandora.com
  31. @ablythe DOMAINS • redirector.gvt1.com • *.tritondigital.com • *p-cdn.com • tunein.com

    • sb.scorecardresearch.com
  32. @ablythe

  33. @ablythe

  34. @ablythe DOMAINS • redirector.gvt1.com —> Registered to google • *p-cdn.com

    -> Pandora • *.tritondigital.com • tunein.com • sb.scorecardresearch.com
  35. @ablythe

  36. @ablythe

  37. @ablythe

  38. @ablythe

  39. @ablythe

  40. @ablythe DOMAINS • redirector.gvt1.com —> Google • *p-cdn.com —> Pandora

    • *.tritondigital.com —> Podcasts/Streaming • tunein.com —> Podcasts/Streaming • sb.scorecardresearch.com —> ??
  41. @ablythe

  42. @ablythe

  43. @ablythe Data to Home Company Data to 3rd Parties I

    Expect Data to 3rd Parties that Surprise Me
  44. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  45. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? HOW MUCH? HOW OFTEN?
  46. @ablythe • Plugin Ethernet • Create a Network • Connect

    Device (Echo Dot or Google Home Mini) • Reference • https://support.apple.com/kb/PH25327?locale=en_US • https://stackoverflow.com/questions/7166044/how-can-i-configure-wireshark-to-see-https- traffic
  47. AMAZON ECHO DOT @ablythe

  48. @ablythe Alexa, What’s the Weather

  49. @ablythe

  50. @ablythe Alexa, what sound does a pig make?

  51. @ablythe Silent TV On

  52. GOOGLE HOME MINI @ablythe

  53. @ablythe Ok Google, What’s the Weather?

  54. @ablythe 216.58.216.68 -> 1e100.net -> 1e100 is scientific notation for

    1 googol -> Name “Google”
  55. @ablythe OK Google, what sound does a pig make?

  56. @ablythe Silent TV On

  57. @ablythe Echo Dot with TV On Google Home with TV

    On
  58. @ablythe Data when interacting ~ 5 to 10 seconds Data

    when silent ~ 3 mins Data when tv on ~3 mins 46,665 7,728 2,035 187,967 36,176 33,276
  59. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  60. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT HAVE I AGREED TOO?
  61. AMAZON ECHO DOT @ablythe

  62. @ablythe AMAZON ECHO • Alexa Terms of Use: • https://www.amazon.com/gp/help/customer/display.html?

    nodeId=201809740 • Amazon Privacy Notice: • https://www.amazon.com/gp/help/customer/display.html? nodeId=201909010
  63. @ablythe

  64. @ablythe

  65. @ablythe

  66. GOOGLE HOME MINI @ablythe

  67. @ablythe GOOGLE HOME • Google Home Privacy: • https://support.google.com/googlehome/answer/7072285?hl=en •

    Google Privacy Policy: • https://www.google.com/policies/privacy/ • Archive • https://www.google.com/policies/privacy/archive/
  68. @ablythe

  69. @ablythe Creates Voice Profile Allows Deletion Easy to find archive

    of agreement
  70. @ablythe Creates Voice Profile Allows Deletion Easy to find archive

    of agreement ? ?
  71. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  72. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT’S STORED ON THE SERVER SIDE?
  73. AMAZON ECHO DOT @ablythe

  74. @ablythe www.amazon.com/mycd

  75. @ablythe

  76. @ablythe

  77. GOOGLE HOME MINI @ablythe

  78. @ablythe https://myactivity.google.com/myactivity

  79. @ablythe https://www.google.com/maps/timeline

  80. @ablythe

  81. @ablythe

  82. @ablythe

  83. @ablythe https://twitter.com/iamdylancurran/status/977559925680467968

  84. @ablythe

  85. @ablythe Deletion is clear and what you would expect

  86. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  87. @ablythe https://www.nytimes.com/2016/03/10/technology/the-echo-from-amazon-brims-with- groundbreaking-promise.html

  88. @ablythe http://www.techtimes.com/articles/207375/20170516/amazon-wants-to-make-sure-alexa- responds-only-when-you-actually-call-her.htm

  89. @ablythe

  90. @ablythe https://twitter.com/iamdylancurran/status/984123375537844231

  91. @ablythe http://appft.uspto.gov/netacgi/nph-Parser? Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1& f=G&l=50&s1=%2220170323645%22.PGNR.&OS=DN/20170323645&RS=DN/20170323645

  92. @ablythe

  93. @ablythe

  94. @ablythe SMART TV’S

  95. @ablythe

  96. @ablythe HTTP://AARONBLYTHE.ORG/