Police can access a trove of data from smart speakers found at crime scenes that could be invaluable in solving murders or burglaries, say researchers. Data on recently recognised faces, internet searches and any voice commands received could be extracted even without the owner鈥檚 permission or assistance from the manufacturer.
Jona Crasselt and at the University of Erlangen-Nuremberg in Germany decided to explore how much information can be pulled from these devices聽after seeing news coverage of .
鈥淲e were happy to [find] that we not only obtained access to the local data, but also were able to access the data stored in the cloud,鈥� says Pugliese. 鈥淏ecause, in such a way, forensic investigators would be able to access the data themselves without relying on Amazon to provide it to them.鈥�
Advertisement
The researchers focused on Amazon鈥檚 Echo Show 15, a smart assistant equipped with a large display screen, a camera, six microphones and an ambient light sensor.
Their first tactic was to probe inside the Echo Show with a device designed to test what signals or data are flowing at various points on a circuit board. They were able to gain access to the unencrypted file system of the Echo Show, revealing logs of detected movement and faces recognised by the built-in camera and artificial intelligence.
In this file system, they also found a 鈥渞efresh token鈥�, which is used to access data stored in the cloud. This was encrypted, but with a key found elsewhere on the device in an unencrypted file and information gleaned from open-source code published online, they were able to easily decrypt the token and access anything that the device was authorised to access. This approach revealed details of voice requests, calendars, contacts, conversations, photos and videos.
鈥淚t requires some technical knowledge to obtain the local data, but it was surprising that the file system was not encrypted,鈥� says Pugliese. 鈥淚t鈥檚 the common cat-and-mouse game in security research: the vendor will probably change some things in the future, and then new [security] examinations will be necessary for the next generation of devices, and so on.鈥�
An Amazon spokesperson told 快猫短视频: 鈥淭he security of our devices and customer data is a top priority. In this case, the researcher鈥檚 findings required direct physical access to the Echo device and specialised expertise to extract data from internal device components. We appreciate the work the security research community does to help us further improve our devices.鈥�
Criminologist , an emeritus professor at Birmingham City University, UK, says that the use of technology and science in murder investigations is far less prevalent than television crime dramas would suggest: less than 2 per cent of murder trials rely on DNA evidence, for example.
鈥淭here鈥檚 a sense that it鈥檚 technological advances, it鈥檚 forensic science that鈥檚 going to really drive the solutions to these crimes, and it鈥檚 not 鈥� it鈥檚 a simple human reality that you鈥檙e most likely to be murdered by someone you know,鈥� says Wilson. 鈥淲e already have access to information from those domestic settings through mobile phones, Facebook, Instagram posts. It鈥檚 the first thing that often takes place in a murder investigation 鈥� check the Facebook, who are they friends with?鈥�
Wilson says that while smart speaker evidence could conceivably be useful in a small number of cases, there are also concerns about the privacy trade-off this would bring. 鈥淭here are creeping human rights issues about these technological advances that we would do well to not ignore,鈥� he says. 鈥淚 think it鈥檚 right that Amazon would be a bit reluctant to release that information, because there are privacy issues.鈥�
arXiv
