For smart speaker owners or those thinking of purchasing one, it is good practice to understand the privacy and security risks that come with smart speakers. This will give us an idea of the precautions that we can take against these weaknesses in our networks and how we can securely use these devices.

Smart Speaker Privacy Concerns

• “Always-on” Microphones

Many users worry about the privacy of smart speakers, especially when it comes to how their private conversations are being handled. We might think that the speakers from the big three tech companies– Amazon, Google and Apple – are safe to use, but how do we manage the risks these recording devices and their “always-on” microphones pose?

Smart speakers are always “listening” for a special phrase, also known as “wake words,” to trigger a command, like “Alexa”. Ideally, if a wake word isn’t said, the speaker shouldn’t be listening nor recording, but how can we be sure?

• Accidental Smart Speaker Recordings

By default, smart speakers are always listening. They should only record if you first utter the wake word for it to activate. This is how they know when to listen for a request.

However, there is the possibility for accidental recordings to occur. For example, misheard words like, “Alicia” instead of Alexa or “bugle” instead of “OK Google” can trigger smart speakers to record and process sound or conversations not meant for them. One way to avoid accidentally triggering your smart speaker is to change the wake word, which some speakers allow you to do.

• Storage of Recordings and Human Review

Though audio recordings are stored locally on the device, some of these recordings are also sent to cloud servers for processing. The purpose of these are to improve the quality of voice services.

Policies around recordings and their usage have been changing due to the increase in smart speaker adoption, but to what extent are the limitations of these policies protecting user privacy? In recent years in the United States, recordings from smart speakers have been used as evidence in investigations and court cases.

Smart Speaker Security Issues

Homes and businesses should be careful about their smart speaker setup as they may introduce risks in their network’s security. Hacking and unapproved eavesdropping now pose a real threat when it comes to smart speakers.

• Smart speakers can be triggered by any voice

Though smart speakers can be configured to remember and recognize your voice, by default they are set up to be prompted by any voice. Your friends’ voices can trigger a smart speaker if they are close enough and even voices that come from your TV can activate recording.

• Hacking of Cloud Recordings

Audio recordings sent off to the cloud can be intercepted. These recordings are voice commands that you want your smart speaker to remember.

• Hacking the Internet of Things (IoT)

Hacking a smart speaker is not new. A malicious actor was able to install malware onto an Amazon Echo speaker . The hack forced the device to always listen, allowing someone to hear everything happening in the victim’s home.

• Unauthorized Use

There are also other methods to gain unauthorized access to your smart speaker. For example, physical methods like using light and sound aimed at your speaker to trigger recording . As complex as it can be, this method can succeed from a distance and can be used to trick the speaker to open your door for them if you have a Smart Door lock.

Protecting your Smart Speaker

Device manufacturers have implemented security measures to avoid any security incidents on your device and on your data, but this won’t stop hackers and threat actors for finding ways in compromising your device.

It’s best to have a first line of defense to protect your devices and your home network as a whole: use Trend Micro Home Network Security!

To learn more about Trend Micro Home Network Security, please click here.