Amazon’s Alexa is good at listening, since it has to be ready when you say its wake word, like “Alexa,” “Echo” or “Computer.” That very same feature, though, has people worried about their own privacy. Researchers from security firm Checkmarx have found a way to get Alexa to listen in and send a transcript of any conversations that it records while eavesdropping.
The researchers were able to create a harmless-seeming Alexa Skill that would actively record long after most Skills shut down to preserve people’s privacy. Checkmarx’s Amit Ashbel told CNET that it could just keep recording. “As far as we could tell, there was no limit,” he said. “As long as you [didn’t] tell it to stop, it wouldn’t.”
Checkmarx says that it notified Amazon of this exploit at the beginning of April; Amazon confirmed to CNET that it has since fixed the issue. “Customer trust is important to us and we take security and privacy seriously,” a spokesperson said in a statement. “We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do.”
This article originally appeared on Engadget.
