[Paper Review] Security Vetting Process of Smart-home Assistant Applications: A First Look and Case Studies

Hang Hu, Limin Yang+2 more|arXiv (Cornell University)|Jan 13, 2020

Advanced Malware Detection Techniques41 references4 citations

TL;DR

This paper investigates the security vetting process for smart-home assistant applications, focusing on cloud-to-endpoint authentication in Amazon Alexa and Google Home. It reveals that both platforms fail to properly enforce secure authentication, allowing attackers to spoof cloud traffic and compromise third-party endpoints; 219 vulnerable Alexa endpoints were identified in the wild, including critical applications for smart devices and electric vehicles.

ABSTRACT

The popularity of smart-home assistant systems such as Amazon Alexa and Google Home leads to a booming third-party application market (over 70,000 applications across the two stores). While existing works have revealed security issues in these systems, it is not well understood how to help application developers to enforce security requirements. In this paper, we perform a preliminary case study to examine the security vetting mechanisms adopted by Amazon Alexa and Google Home app stores. With a focus on the authentication mechanisms between Alexa/Google cloud and third-party application servers (i.e. endpoints), we show the current security vetting is insufficient as developer mistakes can not be effectively detected and notified. A weak authentication would allow attackers to spoof the cloud to insert/retrieve data into/from the application endpoints. We validate the attack through ethical proof-of-concept experiments. To confirm vulnerable applications have indeed passed the security vetting and entered the markets, we develop a heuristic-based searching method. We find 219 real-world Alexa endpoints that carry the vulnerability, many of which are related to critical applications that control smart home devices and electronic cars. We have notified Amazon and Google about our findings and offered our suggestions to mitigate the issue.

Motivation & Objective

• To examine the security vetting mechanisms used by Amazon Alexa and Google Home for third-party smart-home assistant applications.
• To identify gaps in the vetting process that allow insecure authentication practices to pass undetected.
• To validate the feasibility of cloud-spoofing attacks on third-party application endpoints through ethical proof-of-concept experiments.
• To assess the real-world prevalence of vulnerable applications in production markets.
• To provide actionable recommendations for improving vetting processes and developer guidance to enhance application security.

Proposed method

• Developed custom vulnerable skills to simulate real-world implementation mistakes and walk through the automated and manual vetting processes of Alexa and Google Home.
• Conducted controlled proof-of-concept experiments to demonstrate cloud spoofing attacks using signed traffic from an attacker’s skill to target legitimate endpoints.
• Leveraged ZMap to scan for live HTTPS hosts and replay non-intrusive spoofed queries to detect endpoints that accept unsigned or replayed traffic.
• Analyzed the results to identify endpoints that failed to validate application identifiers and timestamps, indicating weak authentication.
• Reported findings to Amazon and Google, offering recommendations for improved automated testing and SDK-level security enforcement.
• Used heuristic-based scanning to identify vulnerable endpoints in production, focusing on Alexa due to its automated vetting process.

Experimental results

Research questions

• RQ1 How effective are the automated and manual vetting processes of Amazon Alexa and Google Home in detecting insecure cloud-to-endpoint authentication mechanisms?
• RQ2 To what extent do current vetting processes fail to detect critical authentication flaws such as missing application-ID validation and timestamp checks?
• RQ3 What is the real-world prevalence of vulnerable third-party application endpoints in public app markets for smart-home assistants?
• RQ4 Can attackers successfully spoof cloud traffic to compromise third-party endpoints due to weak or missing authentication checks?
• RQ5 What improvements can be made to the vetting process and developer tooling to prevent such vulnerabilities from being introduced in the first place?

Key findings

• The Google Home vetting process does not require endpoints to authenticate the cloud, leaving them vulnerable to spoofed queries.
• Amazon Alexa’s automated vetting process fails to detect critical authentication flaws, such as missing application identifier checks, allowing vulnerable skills to pass.
• A proof-of-concept attack demonstrated that an attacker can reuse a valid cloud signature from their own skill to impersonate the cloud and target other endpoints.
• ZMap-based scanning identified 219 real-world Alexa endpoints vulnerable to cloud spoofing, including applications controlling smart home devices and electric vehicles.
• Many of these vulnerable applications had passed both automated and manual vetting, indicating systemic flaws in the current security review process.
• The study confirms that current vetting mechanisms are insufficient to prevent insecure authentication patterns from reaching production markets.