Alexa, What Happened to My Car?
“As we make everything smarter and more connected,” said Nadir Izrael, chief technology officer of the internet
security firm Armis, “we end up creating a huge attack surface on devices, like cars, that weren’t intended.”
Last year, Armis discovered one such vulnerability — known as BlueBorne —
that exposed billions of connected devices, including Amazon’s Echo and Google’s Home smart speakers, to the possibility of being hijacked by hackers.
And even though voice bots like Alexa and Google’s Assistant can be taught to recognize different voices — well enough to cater to each
family member’s favored Pandora stations, for example — they do not offer any sort of biometric security, such as voice print analysis.
Alexa, on the other hand, is intended — via specific, preprogrammed commands — to interact with thousands of connected devices, performing
tasks like turning on lights, opening door locks, disabling home security systems or even ordering a year’s supply of toilet paper.
And even if they do establish biometric security features, Mr. Wang said, regenerative machine learning
could use a recording of a person’s voice to synthesize new commands that could fool them.
Simple Alexa commands can flash the lights or honk the horn, Ms. Barfuss said, but remote instructions
that alter the state of the car — such as locking the doors and starting the engine — also require a spoken PIN code.