English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Virtual personal assistants (VPA) (e.g., Amazon Alexa and Google Assistant)today mostly rely on the voice channel to communicate with their users, whichhowever is known to be vulnerable, lacking proper authentication. The rapidgrowth of VPA skill markets opens a new attack avenue, potentially allowing aremote adversary to publish attack skills to attack a large number of VPA usersthrough popular IoT devices such as Amazon Echo and Google Home. In this paper,we report a study that concludes such remote, large-scale attacks are indeedrealistic. More specifically, we implemented two new attacks: voice squattingin which the adversary exploits the way a skill is invoked (e.g., "open capitalone"), using a malicious skill with similarly pronounced name (e.g., "capitalwon") or paraphrased name (e.g., "capital one please") to hijack the voicecommand meant for a different skill, and voice masquerading in which amalicious skill impersonates the VPA service or a legitimate skill to steal theuser's data or eavesdrop on her conversations. These attacks aim at the wayVPAs work or the user's mis-conceptions about their functionalities, and arefound to pose a realistic threat by our experiments (including user studies andreal-world deployments) on Amazon Echo and Google Home. The significance of ourfindings have already been acknowledged by Amazon and Google, and furtherevidenced by the risky skills discovered on Alexa and Google markets by the newdetection systems we built. We further developed techniques for automaticdetection of these attacks, which already capture real-world skills likely topose such threats.

Understanding and Mitigating the Security Risks of Voice-Controlled Third-Party Skills on Amazon Alexa and Google Home