BSidesAtlanta 2019 - Wes Lambert - Alexa Knows My Kids Better Than I Do

hopefully everybody got some good talks and today learned a lot of new things right awesome so this talk is going to be a little bit of a departure from what I talked about are the types of things typically it's a little more technical this is going to be what's more focused on the privacy aspect and aspect of owning smart devices or using services so the title of this talk Alexa knows my kids better than I do I think it kind of sums up the state of devices today I really you know just just they're invasive as when they're pervasiveness into our daily lives and I'm gonna go back through that course here in just a minute

other than what has been introduced already I am a husband and father of four I am also known as the Eco manager of household operations at my own I work for security and in solutions as mentioned and I mainly deal with enterprise security monitoring solutions so helping people to stand up oh space intrusion detection systems network-based intrusion detection log management types of stuff like that so I love doing that stuff however this of course again is a nice departure from that I love coffee and I have to have coffee in the morning please I'm talking if I have to have it and I've had it and I security software enthusiasts which means I love going through you know just

like security and it's completely open-source I love going through and other tools that can be abused to enterprises and really trying to tie those together to make them effective so again our world today there's really a complex assortment of devices everywhere you look everywhere you go you're either being recorded somebody or someone's listening to you and these devices a lot of them you know their roles really are as an assistant presence so a digital assistant may be that help with collaboration with coworkers or maybe just for entertainment purposes right we wanted to tell us a joke or when in your song things of that nature so being a parent and really just a human being in

general this damage is kind of scary because of all these things again so many things to interact with and so much data capture and really stored outside of our control or we don't know if it's been duplicated and elsewhere just lots of things to consider devices services so Alexa in general most of you probably know what Alexa is already there's anybody here in having it at Alyssa enable device in their own they're currently using oh so in a nutshell just a virtual assistant developed by Amazon super popular these days uses a natural language processing to go do things for you and remember results and it ultimately it just provides that capability for automation and convenience right so just allowing you

to go do stuff like setting a timer playing a song or something else I'm just hopefully saving you time and giving you some benefit out of that process now there are a ton of a lesson enabled devices you can see a few here of course the echo echo dot show and of course they're integrated into other third parties like neck get your saw hardware I'm sorry GE so smart switches smart outlets all sorts of stuff even devices running Windows 10 can use Alexa along with Cortana so once again it gives you a lot of capability at really Amazon a lot of capability to peer into your life and the lives of your family to see what's going on see what you're

doing a few stats so right here some of these are from different time periods but it was really the most it's credible that I can find so twenty thousand number was the number of unique devices on which Alexa is available right so you're talking about across hardware manufacturers you're talking about different models and stuff like that and the number of skills available so those skills typically refer to you know something Alexa can do of his service reaching out to us and then finally 100 million there are a hundred million devices running Alexa in general her sold at least to the public today and that was at the end of q4 of 18 so they're obviously way out so how

it works in a nutshell and this is an extremely technical at all so please forgive any technical inaccuracies but in general lessons waiting on a wait word right so it's waiting on you to give it that hot where it's a traitor and do its thing so it's always listening you know like locator and I'll show you that the device is listening and we store the echo devices and it will go off once you say that hot word and that word and then it will go off to the cloud servers it'll say hey what you got for me yeah but either way you know once it's received it once is triggered that hot word the surface are gonna

store that possible yeah always recording and then they're gonna try to if you have the development features enabled their automatic they're going to try to train Alexa with that and they're just gonna store it indefinitely on their servers unless you go mess with it or review it so once again once it gets back to those results its visit out to you and either understood what you said or it didn't and you know you get something back yourself also how it works in a nutshell this sounds like wait word right and I think it happens all too often with with many folks and and I'll talking about a little bit more second but something else you know this

is a man record in this ticker conversation nice is like don't worry it is and then the clown says once again let's store it so they still store the data even though it wasn't a valid request and then alexinnz comes back won't respond the board of the study that doesn't know what it is so it's it's something to keep in mind that not only it is valid requests you know it's listening in for that WIC word and not only this reality of was that provide the WIC word but ones that sound acoustically similar and they'll be able to effectively discern it and you know that's it's gonna be a flaw with the software in general so once again a wait

word is not always awake word mistakes happen everybody knows computers are hard humans are not perfect no where are the machines that they intend to perfect right so an imperfect human can I create a perfect machine therefore we have to expect some mistakes are gonna occur and some day is gonna be collected when it was not inside too

and here's Chuck Norris just kicking a negative doctors all right so they've collected Emma's on collects a lot of data now just general I'm going to that but through the alexa service it's really trying to provide it's extending to that service to provide 360-degree view of yourself to amazon and this is all really for Amazon to of course potentially make more money they're trying to do a profile of you right so a lot of times when when folks think about you know they're taking my data and simply solo to third parties and stuff like this it's not necessarily the case with Amazon or they like the service it's much more valuable for them to have

your data and be able to use that data and have exclusively since I believe it was seventy-five percent of most folks doing online shopping done it so they definitely want that information they don't want to give that away so easily so some of the data that it collects is with regards to language right so our vocabulary the words that we use right so people with different upbringing as may use different vocabulary you know people just people in general right just depending on their education level or their personal preferences and it seeks to understand that to better training service all right so it's taking that voice recording and everything that it's learning from you and analyzing all those words that you

say in addition your speech patterns so maybe your cadence right so the way that I am talking now it may see things like that and better learn to process speech with pauses or things like that so there are a lot of different ways that it processes work it interprets your language to better people to you in the future so personal preferences honestly a lot of you know websites or services do this but again this is you know using the service it's again another entry point to providing that data and compiling a profile the deadline floor so it might be John there's a music for which you're searching specific artists things like that it might be types of venues for you

know if you're looking they go out drink have a buy a pizza things like that and of course maybe styles of clothing that you purchase you know what which would make some where it's all looking at these different things trying to go to

and once again that's kind of guys in hand sorry in a hand in hand with the personal preferences of course a lot of those personal preferences are going to be tied to certain buying habits right so well people may not always act on approaches you know from searching for these different items and they're still gonna track the types of things that we're buying the brands of things that you're buying how often you're buying it are there certain intervals they buy so maybe they can recommend or they can fold in some type of discount later based on your buying habits right it's all for that whole money dollar some other data so if you have any Smart

Switches right and they smartly outlets house fixtures lamps still like that so like thermostats that use Alexa and echo B or something it's going to store all of that as well so if we get status indicators from that various details from those devices right and it's gonna store all that and once again with your other activity once again I just want to reiterate on the voice recordings that Alexa I'm sorry the Amazon storing through this device of service you have this clips of audio that are stored from successful and unsuccessful attempts so again that's something to keep in mind and these are really stored indefinitely unless they go out proving them because I'm you know there's no need to give her

that data and rolling some of that that marketing power or appeal then they won't do it and by the way I'm not trying to make it in the house and that guy so today to review are you - sing this in the news recently it came out most popular has no last few days but Amazon actually employs a lot of people that look at these voice recordings they're essentially trained to go through and look at these and help train the Alexa service to better utilize his voice recordings and interpret them so it helps them to transcribe that the workers health and scientists yeah transcribe that information and when I mentioned that loaded details are paired

with these recordings I still feel like an account number a person a mana device serial number are still not something that I would want associate it was a recording and I would think that it's still not that difficult to correlate that with user identity right either through another customer service representative or some other access that that boy had I said that I think it's me a little pause and once again recordings even consist of private conversations singing in the shower I children the crying for help you know maybe they got a boo-boo and they're asking for dad my mom are you in criminal activity right I mean it's anything

so a few kicks is in the news I mentioned that they announced the the workers that I was analyzing the recordings but there's also another case so State vs Timothy barrel this was a double murder case in which an echo device was present and the judge actually ordered the recordings to be turned over to the state of New Hampshire you know this is something that we're gonna see then and again time and time again as his devices proliferate in people's homes I'm gonna see potentially turned over to government for some sort of purpose or effort to either prove or disprove a crime right another case James based in Arkansas was another suspected murder of colleague it

was eventually dropped the charges were he actually voluntarily handed over their horns though in that case you know it might have actually helped him that he had that and it disproved their hypothesis or at least I did not give any credence to you know there are other arguments and also a family in Portland Oregon you might have heard about this one they were talking about some of our wood floors just chilling at home and for some reason right now they're Alexa thought they wanted to initiate interaction with Alexa and then that private conversation actually got sent to one of the husband's contacts with one of the workers as employees so there's definitely some stuff there that

once again kind of gives me pause and I struggle with this because of things like this ultimately it's about trust right we are trusting Amazon to protect our data as well as our children's data whenever they're recording this right and the best assurance that we have is the thing or are the things that they tell us through public announcements through the terms of use on the website through the privacy settings that we enable are disabled and that's really all we know unless there's some some big breach right where it comes out that you know some things were handled as we thought they were so that's really all we have is trust we can trust them but honestly

we have nobody to verify the verify and I want to talk about kids so obviously I you guys know kids know a lot of Technology at school right and I rides with a lot of Technology so you know there's computer-based learning all this stem right all these activities that are allowing kids to interact with you know different services and different concepts and it's important that we really teach some of these things well and I'll get to that in just a minute and of course at home right other technology and entertainment purposes like YouTube Facebook my plate for tonight minecraft roblox that my kids have tech knowledge is not necessarily a bad thing just with adults

profiles so Amazon all sorts of people and that services are leveraging those profiles and data points to market and appeal to various folks right and that's one thing that we have to keep in mind as parents how our kids interact with that how what kind of profile they're gonna have published by the time they're 18 already nothing interacted with these services

and profiles right so profiles really consist of hundreds sometimes thousands of data points just depends really on what aspects of these services that you interact with another gathered through various interactions there's personal details that spoke up before are all garnered into this profile and simply those profiles are paired with things like predictive analytics right so some make decisions basically about how it's going to market to users what's going to appeal to them and things of that nature right and these profiles may even yield the tales that maybe parents don't know about their kids right how they've interacted with service details that derailleur conversation or regular interaction us as human beings would not know so it's very important that we are

aware of that activity and you know just just thinking about that kind in the back your head what kind of profile are you said how worried your children or profile I think I have when they're older again use of technology with limited knowledge or awareness can be dangerous it can cause unintended consequences right and I promise I don't have the tempo hat on I'm just trying to kind of keep you yeah just thinking about these things and potential long-term irrevocable effects right everything that we put on the internet it's there forever right and this activity or you know this limited use is really propagated through social norms right it's normal to use Facebook right it's normal to use Alexa it's

normal to do all of these things so I'll talk a little bit about that so social norms really what are they they're unwritten rules a behavior acceptable anywhere in society and you have various types of course both ways more instead boobs won't getting that into that too much but they essentially exist to provide order and society and really it's important for us to as human beings to be effective in society to conform to the contract need to be an effective member of our society and in the past expectation of privacy was always social norm right so it's just a given so going with a bit more on social norms they're driven by advancements and technology so things like watching even

throwing the stranger things playing for that again or utilizing smart devices in general these are become social norms for us right norm to trade that convenience so what happens if we don't conform to these social yeah yeah privacy either that right so we can lighten men you mean we don't have to use these do you mean it's not that much of a benefit to use these but I'm still giving away all this privacy I don't think I want to do that so I mean there could be enlightenment right it's not always the case there could be alien Asian I can cause a decrease in confidence anxiety or increase things I think and it can affect relationships right like we

secure the Grandma's house anymore yeah we've talked to her over the echo show ok so how does that affect your relationship and then also affecting change so it offers a new perspective you know folks that don't want you see these devices but it requires the cool clear second support and really early you know being a stakeholder and really supporting me through that and affecting other people so what happens if we can form when we need to cookies right we have a natural desire to conform to peer pressure and group judgment so we have to set that loss of privacy which really isn't immediately quantifiable and only at the seats of the use of the Alexus

service can we really begin to I guess calculate and not really to a finite degree the effects of what's been reported or what we've provided so once again I'm running low on side we're mishandling exposure I'm sorry there's the potential for and when your exposure there so we can't trust that it's always going to be handled correctly even though this is and we're always training convenience over prices is demanding here is that we're giving them bits of data so that we can go set a timer for an egg right and they can make mad cash and that's just I mean yes there are certain certain benefit but it's just really you know it depends on that so we can take

that control don't take steps right so we can have a proactive approach and a lot of that's really built into in Lund settings themselves they've done a good job of that I just think they could do a better job of publicizing it right making it more well known so there's an interface there the Alexa privacy okay sure all right and so then we can actually see the voice history all the voice recordings that Alexa has ever recorded right Alexa I'd like to watch the office here's what I've found so it transcribed that one right there because it's not what I was talking about but this one up here I didn't know what I was talking

about I was talking to my kids so it's definitely important to review this type of information I think on a regular basis let's make sure that you know there aren't in unintended consequences there and once again the smart alert history if you've got smart devices you can see all that type of stuff here I'm sorry like you know the switches and outlets and things of that nature even smoke and CO two Testaments right and then this is really gonna be the more general third-party home devices in which you interact with where you can delete the history there so it's also another cool point and also to school permissions you can limit the permissions or at least you can review

them on here so each skill that you're using you can see what permissions they have in this various types of data and finally I mentioned this earlier but the feature development you can actually disable participation on this and they will not be reviewing your recordings although they may still hand select some of them from time to time they will not go through that same procurement process or that same review process and another protection just muted right so it's simple but effective you know you have to go over there and what press apply right but a trade convene surprises and what's a DV trusted yeah yeah do you trust it too and once you meet it do you

trust it right you trusted is actually music all right all right or just play it all together right no power there were problems but but really what's the point if you're on blame right if if you you know it's just it really it takes you know a certain expectation you just have to have that hand in hand expectation of privacy right like wait a minute wouldn't even up could be nice wise what's that yeah shooting you can't she can't go to the fire certainly yeah but you know real quick just some alternatives I just wanted to mention not to try to sell people on not getting a lesson in with devices but they're all are open-source all turns out there

they'll actually store the data locally and not send it off and you can do this on your own Raspberry Pi as well and I think West Widener and his talk sound of evil actually talks about this a little bit and he mentions this next thing I'm going to talk about but yeah Mycroft is that company pretty cool I haven't done yet but definitely interested in you have the mark one okay some thinking the consideration so the other thing I was gonna talk about is project alias have you seen project Davis at all no okay so this is essentially again kind of a Raspberry Pi type thing and a 3d printer thing where you can sign it all together and you're

creating essentially a hat or a mask for this and then it's going to sit on top of there and it basically you know intercepts any requests to that microphone right so you're essentially a listing in that divot yeah sure

all right so so yeah you know and and again like I said what's wider to the tail is this a little more technically in his talk so I definitely check that out he's on YouTube he's done said what besides and he was just that this piece out today in the same talk so it's a very good pretty good song I encourage you to check it out but other than that I will leave you some additional resources really just the Alexa Terms of Use and privacy settings I think are just a big helping themselves just what they're already publishing for you howa manages data and of course West winding down here checking out his talk there's this Twitter handle right there

[Applause] alright alright and that is it contact you can reach me on Twitter hit me up at the real W Lambert

[Applause]