Amazon Alexa, usually called “Alexa”, is an AI virtual assistant developed by Amazon, capable of voice interaction, music playback, setting alarms and other tasks, and can be used as an intelligent control device for home automation systems. It is estimated that more than 200 million Alexa-enabled devices will be sold by the end of 2020. Research has found that certain Amazon/Alexa subdomains are vulnerable to cross-site scripting attacks due to cross-domain resource sharing (CORS) configuration errors.
These vulnerabilities enable attackers to:
1. Silently install the app skill on the user’s Alexa account
2. Get a list of all installed skills in the user’s Alexa account
3. Silently delete skills
4. Obtain the victim’s voice record
5. Obtain the victim’s personal information
The victim only needs to click on the Amazon link specially made by the attacker.
Use the Alexa mobile application skill to test and find that it communicates through SSL, uses Frida SSL to bypass SSL Pinning to analyze the traffic, and view the traffic in clear text.
When looking at the traffic, it was found that Skill was configured with the wrong CORS policy to allow Ajax requests to be sent from any other Amazon subdomain. This may allow an attacker to inject code on one Amazon subdomain, thereby launching a cross-domain attack on another Amazon subdomain.
These requests will return a list of all installed skills on Alexa, and will also send back a CSRF token in the response, as shown below:
You can use this CSRF token to perform operations on the target, such as remote installation and enabling new skills.
To make the attack successful, it is necessary to exploit XSS vulnerabilities in Amazon subdomains. CSRF attacks and CORS misconfigurations can be exploited to impersonate victims using their Alexa account to perform operations.
In the following request to track.amazon.com, there are two parameters: paginationToken and pageSize.
Changing the pageSize to a non-numeric character can cause an error on the server side and feed it back to the client, receiving a status code of 500 and a JSON response. The response content type is text/html, so that the parameters can be manipulated to achieve code execution, as shown below:
Now you can use this code injection to trigger an Ajax request with the victim’s credentials and send it to skillstore.amazon.com.
The above request sends all cookies to skill-store.amazon.com, steals the csrfToken from the response, uses this csrfToken to conduct a CSRF attack, and installs it silently on the victim’s Alexa account.
The following is the complete POC code used to install the skill with ID B07KKJYFS9:
The skil is available from the Alexa Skill store:
The victim clicks on the malicious link, and the skill is added to their Alexa account:
Attacks can be carried out in several different ways:
1. The user clicks on the malicious link and is directed to amazon.com where the attacker has code injection.
2. The attacker sends a new Ajax request with user cookies to amazon.com/app/secure/your-skills-page, and obtains a list of all installed skills on the Alexa account and a CSRF token in the response.
3. The attacker uses the CSRF token to delete a common skill from the list received in the previous step.
4. The attacker installs and deletes a skill with the same calling phrase.
5. The user tries to use the calling phrase to trigger the attacker’s skill.
Get a list of skills
The following request allows the attacker to view the victim’s entire skill list:
Silently remove installed skills
The following request allows an attacker to delete a skill from the victim’s account:
Get the victim’s voice history
The following request allows the attacker to obtain the victim’s voice record through Alexa, resulting in the exposure of personal information, such as bank data history.
Amazon will not record bank login credentials, but will record user interactions. Attackers use skills to access victims’ interactions and obtain their data history.
Individual victim information
The following request can be used to obtain user personal information, such as home address, etc.
To sum up
Virtual assistants are often used in smart homes to control IoT devices, such as lights, air conditioners, vacuum cleaners, electricity and entertainment. In the past ten years, they have become more and more popular and play an important role in our daily lives, and with the development of technology, they will become more popular.
However, IoT devices are inherently vulnerable to attacks and still lack sufficient security.