Alexa and Google Are Listening: How Much Are They Transmitting

Presentation from BSidesIowa and BSidesKC 2018

Transcript

1. ALEXA AND GOOGLE ARE LISTENING how much are they transmitting?
2. @ablythe DEMO
3. @ablythe RECORDING HTTPS://YOUTU.BE/OFPGL5Z5DFQ
4. @ablythe https://www.youtube.com/watch?v=vmINGWsyWX0
5. @ablythe
6. @ablythe
7. @ablythe
8. @ablythe
9. @ablythe
10. @ablythe
11. @ablythe
12. @ablythe Aaron Blythe (aaronblythe.com) • Lead Organizer • @devopskc @devopsdayskc sizzle.devopsdayskc.org
13. @ablythe https://youtu.be/r8wl5dcWg5w
14. @ablythe Assistant/Device Cost Test Result Siri/iPhone Too Much/ Have to have What sound does a pig make? Alexa/Echo Dot $49.95 ($29.95 Black Friday) What does a pig say? I’m sorry. I only know English at the moment, I’ll try and learn some animal languages Hey Google/ Google Home $49.00 ($29.99 Black Friday) What sound does a pig make? What does a pig say?
15. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
16. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
17. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
18. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ??? WHAT TRAFFIC IS LEAVING MY HOUSE?
19. AMAZON ECHO DOT @ablythe
20. @ablythe
21. @ablythe
22. @ablythe DOMAINS • api.amazon.com • api.amazonalexa.com • *.amazon.com • *.amazonaws.com • *.pandora.com • *.spotify.com • *.amazoncrl.com
23. @ablythe
24. @ablythe
25. @ablythe DOMAINS • *.cloudfront.com • clients3.google.com • *.amcs-tachyon.com
26. @ablythe
27. @ablythe DOMAINS • *.cloudfront.com —> Needs authentication - Amazon CDN • clients3.google.com —> ??? • *.amcs-tachyon.com —> Registered to Amazon
28. GOOGLE HOME MINI
29. @ablythe
30. @ablythe DOMAINS • *.google.com • *.googleapis.com • *.googleanalytics.com • *.googleusercontent.com • *.gstatic.com —> Registered to Google • pandora.com
31. @ablythe DOMAINS • redirector.gvt1.com • *.tritondigital.com • *p-cdn.com • tunein.com • sb.scorecardresearch.com
32. @ablythe
33. @ablythe
34. @ablythe DOMAINS • redirector.gvt1.com —> Registered to google • *p-cdn.com -> Pandora • *.tritondigital.com • tunein.com • sb.scorecardresearch.com
35. @ablythe
36. @ablythe
37. @ablythe
38. @ablythe
39. @ablythe
40. @ablythe DOMAINS • redirector.gvt1.com —> Google • *p-cdn.com —> Pandora • *.tritondigital.com —> Podcasts/Streaming • tunein.com —> Podcasts/Streaming • sb.scorecardresearch.com —> ??
41. @ablythe
42. @ablythe
43. @ablythe Data to Home Company Data to 3rd Parties I Expect Data to 3rd Parties that Surprise Me
44. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
45. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ??? HOW MUCH? HOW OFTEN?
46. @ablythe • Plugin Ethernet • Create a Network • Connect Device (Echo Dot or Google Home Mini) • Reference • https://support.apple.com/kb/PH25327?locale=en_US • https://stackoverflow.com/questions/7166044/how-can-i-configure-wireshark-to-see-https- traffic
47. AMAZON ECHO DOT @ablythe
48. @ablythe Alexa, What’s the Weather
49. @ablythe
50. @ablythe Alexa, what sound does a pig make?
51. @ablythe Silent TV On
52. GOOGLE HOME MINI @ablythe
53. @ablythe Ok Google, What’s the Weather?
54. @ablythe 216.58.216.68 -> 1e100.net -> 1e100 is scientific notation for 1 googol -> Name “Google”
55. @ablythe OK Google, what sound does a pig make?
56. @ablythe Silent TV On
57. @ablythe Echo Dot with TV On Google Home with TV On
58. @ablythe Data when interacting ~ 5 to 10 seconds Data when silent ~ 3 mins Data when tv on ~3 mins 46,665 7,728 2,035 187,967 36,176 33,276
59. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
60. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ??? WHAT HAVE I AGREED TOO?
61. AMAZON ECHO DOT @ablythe
62. @ablythe AMAZON ECHO • Alexa Terms of Use: • https://www.amazon.com/gp/help/customer/display.html? nodeId=201809740 • Amazon Privacy Notice: • https://www.amazon.com/gp/help/customer/display.html? nodeId=201909010
63. @ablythe
64. @ablythe
65. @ablythe
66. GOOGLE HOME MINI @ablythe
67. @ablythe GOOGLE HOME • Google Home Privacy: • https://support.google.com/googlehome/answer/7072285?hl=en • Google Privacy Policy: • https://www.google.com/policies/privacy/ • Archive • https://www.google.com/policies/privacy/archive/
68. @ablythe
69. @ablythe Creates Voice Profile Allows Deletion Easy to find archive of agreement
70. @ablythe Creates Voice Profile Allows Deletion Easy to find archive of agreement ? ?
71. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
72. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ??? WHAT’S STORED ON THE SERVER SIDE?
73. AMAZON ECHO DOT @ablythe
74. @ablythe www.amazon.com/mycd
75. @ablythe
76. @ablythe
77. GOOGLE HOME MINI @ablythe
78. @ablythe https://myactivity.google.com/myactivity
79. @ablythe https://www.google.com/maps/timeline
80. @ablythe
81. @ablythe
82. @ablythe
83. @ablythe https://twitter.com/iamdylancurran/status/977559925680467968
84. @ablythe
85. @ablythe Deletion is clear and what you would expect
86. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services Other Services Client Pandora… etc ???
87. @ablythe https://www.nytimes.com/2016/03/10/technology/the-echo-from-amazon-brims-with- groundbreaking-promise.html
88. @ablythe http://www.techtimes.com/articles/207375/20170516/amazon-wants-to-make-sure-alexa- responds-only-when-you-actually-call-her.htm
89. @ablythe
90. @ablythe https://twitter.com/iamdylancurran/status/984123375537844231
91. @ablythe http://appft.uspto.gov/netacgi/nph-Parser? Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1& f=G&l=50&s1=%2220170323645%22.PGNR.&OS=DN/20170323645&RS=DN/20170323645
92. @ablythe
93. @ablythe
94. @ablythe SMART TV’S
95. @ablythe
96. @ablythe HTTP://AARONBLYTHE.ORG/