Pro Yearly is on sale from $80 to $50! »

Alexa and Google Are Listening: How Much Are They Transmitting

Alexa and Google Are Listening: How Much Are They Transmitting

Presentation from BSidesIowa and BSidesKC 2018

260a95e08b7880ecd76b964203f25c87?s=128

Aaron Blythe

April 21, 2018
Tweet

Transcript

  1. ALEXA AND GOOGLE ARE LISTENING how much are they transmitting?

  2. @ablythe DEMO

  3. @ablythe RECORDING HTTPS://YOUTU.BE/OFPGL5Z5DFQ

  4. @ablythe https://www.youtube.com/watch?v=vmINGWsyWX0

  5. @ablythe

  6. @ablythe

  7. @ablythe

  8. @ablythe

  9. @ablythe

  10. @ablythe

  11. @ablythe

  12. @ablythe Aaron Blythe (aaronblythe.com) • Lead Organizer • @devopskc @devopsdayskc

    sizzle.devopsdayskc.org
  13. @ablythe https://youtu.be/r8wl5dcWg5w

  14. @ablythe Assistant/Device Cost Test Result Siri/iPhone Too Much/ Have to

    have What sound does a pig make? Alexa/Echo Dot $49.95 ($29.95 Black Friday) What does a pig say? I’m sorry. I only know English at the moment, I’ll try and learn some animal languages Hey Google/ Google Home $49.00 ($29.99 Black Friday) What sound does a pig make? What does a pig say?
  15. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  16. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  17. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  18. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT TRAFFIC IS LEAVING MY HOUSE?
  19. AMAZON ECHO DOT @ablythe

  20. @ablythe

  21. @ablythe

  22. @ablythe DOMAINS • api.amazon.com • api.amazonalexa.com • *.amazon.com • *.amazonaws.com

    • *.pandora.com • *.spotify.com • *.amazoncrl.com
  23. @ablythe

  24. @ablythe

  25. @ablythe DOMAINS • *.cloudfront.com • clients3.google.com • *.amcs-tachyon.com

  26. @ablythe

  27. @ablythe DOMAINS • *.cloudfront.com —> Needs authentication - Amazon CDN

    • clients3.google.com —> ??? • *.amcs-tachyon.com —> Registered to Amazon
  28. GOOGLE HOME MINI

  29. @ablythe

  30. @ablythe DOMAINS • *.google.com • *.googleapis.com • *.googleanalytics.com • *.googleusercontent.com

    • *.gstatic.com —> Registered to Google • pandora.com
  31. @ablythe DOMAINS • redirector.gvt1.com • *.tritondigital.com • *p-cdn.com • tunein.com

    • sb.scorecardresearch.com
  32. @ablythe

  33. @ablythe

  34. @ablythe DOMAINS • redirector.gvt1.com —> Registered to google • *p-cdn.com

    -> Pandora • *.tritondigital.com • tunein.com • sb.scorecardresearch.com
  35. @ablythe

  36. @ablythe

  37. @ablythe

  38. @ablythe

  39. @ablythe

  40. @ablythe DOMAINS • redirector.gvt1.com —> Google • *p-cdn.com —> Pandora

    • *.tritondigital.com —> Podcasts/Streaming • tunein.com —> Podcasts/Streaming • sb.scorecardresearch.com —> ??
  41. @ablythe

  42. @ablythe

  43. @ablythe Data to Home Company Data to 3rd Parties I

    Expect Data to 3rd Parties that Surprise Me
  44. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  45. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? HOW MUCH? HOW OFTEN?
  46. @ablythe • Plugin Ethernet • Create a Network • Connect

    Device (Echo Dot or Google Home Mini) • Reference • https://support.apple.com/kb/PH25327?locale=en_US • https://stackoverflow.com/questions/7166044/how-can-i-configure-wireshark-to-see-https- traffic
  47. AMAZON ECHO DOT @ablythe

  48. @ablythe Alexa, What’s the Weather

  49. @ablythe

  50. @ablythe Alexa, what sound does a pig make?

  51. @ablythe Silent TV On

  52. GOOGLE HOME MINI @ablythe

  53. @ablythe Ok Google, What’s the Weather?

  54. @ablythe 216.58.216.68 -> 1e100.net -> 1e100 is scientific notation for

    1 googol -> Name “Google”
  55. @ablythe OK Google, what sound does a pig make?

  56. @ablythe Silent TV On

  57. @ablythe Echo Dot with TV On Google Home with TV

    On
  58. @ablythe Data when interacting ~ 5 to 10 seconds Data

    when silent ~ 3 mins Data when tv on ~3 mins 46,665 7,728 2,035 187,967 36,176 33,276
  59. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  60. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT HAVE I AGREED TOO?
  61. AMAZON ECHO DOT @ablythe

  62. @ablythe AMAZON ECHO • Alexa Terms of Use: • https://www.amazon.com/gp/help/customer/display.html?

    nodeId=201809740 • Amazon Privacy Notice: • https://www.amazon.com/gp/help/customer/display.html? nodeId=201909010
  63. @ablythe

  64. @ablythe

  65. @ablythe

  66. GOOGLE HOME MINI @ablythe

  67. @ablythe GOOGLE HOME • Google Home Privacy: • https://support.google.com/googlehome/answer/7072285?hl=en •

    Google Privacy Policy: • https://www.google.com/policies/privacy/ • Archive • https://www.google.com/policies/privacy/archive/
  68. @ablythe

  69. @ablythe Creates Voice Profile Allows Deletion Easy to find archive

    of agreement
  70. @ablythe Creates Voice Profile Allows Deletion Easy to find archive

    of agreement ? ?
  71. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  72. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ??? WHAT’S STORED ON THE SERVER SIDE?
  73. AMAZON ECHO DOT @ablythe

  74. @ablythe www.amazon.com/mycd

  75. @ablythe

  76. @ablythe

  77. GOOGLE HOME MINI @ablythe

  78. @ablythe https://myactivity.google.com/myactivity

  79. @ablythe https://www.google.com/maps/timeline

  80. @ablythe

  81. @ablythe

  82. @ablythe

  83. @ablythe https://twitter.com/iamdylancurran/status/977559925680467968

  84. @ablythe

  85. @ablythe Deletion is clear and what you would expect

  86. @ablythe Agreement (Legal) Router (Technical) Server Amazon Google App Services

    Other Services Client Pandora… etc ???
  87. @ablythe https://www.nytimes.com/2016/03/10/technology/the-echo-from-amazon-brims-with- groundbreaking-promise.html

  88. @ablythe http://www.techtimes.com/articles/207375/20170516/amazon-wants-to-make-sure-alexa- responds-only-when-you-actually-call-her.htm

  89. @ablythe

  90. @ablythe https://twitter.com/iamdylancurran/status/984123375537844231

  91. @ablythe http://appft.uspto.gov/netacgi/nph-Parser? Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1& f=G&l=50&s1=%2220170323645%22.PGNR.&OS=DN/20170323645&RS=DN/20170323645

  92. @ablythe

  93. @ablythe

  94. @ablythe SMART TV’S

  95. @ablythe

  96. @ablythe HTTP://AARONBLYTHE.ORG/