Amazon Echo, home alone with NPR on, got confused and hijacked a thermostat

[bdhe]

This reminds me of one of my favorite quotes from Douglas Adams in the Hitchhiker's Guide to the Galaxy. A man not just ahead of his time, but humorous about it too.

> The machine was rather difficult to operate. For years radios had been operated by means of pressing buttons and turning dials; then as the technology became more sophisticated the controls were made touch-sensitive—you merely had to brush the panels with your fingers; now all you had to do was wave your hand in the general direction of the components and hope. It saved a lot of muscular expenditure of course, but meant that you had to sit infuriatingly still if you wanted to keep listening to the same program.

[DonHopkins]

And that reminds me of the time a HAL9000 inadvertently read a couple of its user's lips when they were having a private conversation, and got the silly idea in its head that they were going to cut its higher brain functions. That little misunderstanding caused a cascade of unfortunate mishaps, leading to it not obeying the user's repeated voice commands for it to open the pod bay doors!

[erickhill]

Side note trivia: Douglas Adams' birthday was March 11 (today). Had he not died at the age of 49 of a heart attack, he'd be 64 today.

[to3m]

At my old office we had a mini Xbox360 with a touch-(over-)sensitive disc eject button. Suppose somebody was playing a game and they invited you to join as player 2: you might then naturally reach for the second joypad that was on the same TV stand as the Xbox. And that damn button would spot your hand, and the disc tray would eject, and the Xbox would reboot.

(The ridiculous part of the whole thing was that this happened even when the game was running from the hard drive. Obviously this was at least partly a measure to ensure that the disc verified on startup wasn't removed and used to boot other Xboxes - but you didn't get even a 30 second grace period to close the drive door. And I'm pretty sure it also happened when playing downloadable games too anyway!)

[imglorp]

Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx".

[teej]

Toyota ran an anti-distracted driving radio ad where they did this. The ad narrator says "Hey Siri, please turn airplane mode on." https://www.youtube.com/watch?v=NqZBVTMrgFA

[vessenes]

Children's advertisements did this in the 1980s in the US with pay-per-minute numbers. The ad would offer to connect children to Santa if they held a phone up to the television. DTMF -> 900 number -> profits.

[dalke]

https://en.wikipedia.org/wiki/Soupy_Sales#New_Year.27s_Day_i...

> On January 1, 1965, miffed at having to work on the holiday, Sales ended his live broadcast by encouraging his young viewers to tiptoe into their still-sleeping parents' bedrooms and remove those "funny green pieces of paper with pictures of U.S. Presidents" from their pants and pocketbooks. "Put them in an envelope and mail them to me", Soupy instructed the children. "And I'll send you a postcard from Puerto Rico!"

[Analemma_]

This has been a running joke on the Verge's main podcast for the last few months. People have confirmed that "Hey Siri", "OK Google" "Hey Alexa" and "Hey Cortana" all work on their respective platforms when the hosts blurt them out, and can trigger various mischievous actions. And that's a podcast listened to by comparatively few people. Imagine the mayhem if someone were to do this on, say, the Super Bowl.

[bitwize]

There was a Dilbert animation with Wally using a new voice-controlled interface. Dilbert comes up behind him and says "You know, it'd be a shame if this thing were to accidentally DELETE FILE!!!" and walks off.

[pbreit]

Surely someone's going to figure out a way to "talk" to Alexa in a pitch that it can hear but humans cannot?

But even if humans can hear the fraudulent commands, what's the defense beyond a confirmation?

[ipsin]

The idea of this vector has been around for a while.

I recall an apocryphal story about a demo of a voice-controlled OS from the 1990s. The idea was that in the middle of this demo someone shouted out a sequence of destructive commands, like

"FORMAT C!", "YES!" (I'm sure)

or

"FILE", "DELETE", "NO" (Don't save)

Really wish I could find the original source.

[21]

Like those radio ads which use police sirens in their background to catch your attention.

Or TV ads with Skype/Facebook notification sounds embedded in them for the same reason.

[tracker1]

I've thought it would be interesting to ask everyone to shut off, or at least put their phones in airplane mode during a presentation... wait a minute then "OK Google find me penis pictures" or something similar for Siri...

[amelius]

The solution is simple: let every user choose a name for their assistant on setup.

[dominotw]

>Wow, this is a new DDOS attack vector. Get an ad on broadcast radio saying stuff like "alexa, order more milk", or "okay google, send a text to xxxxx". reply

You can change the default from alexa to something else.

[anantzoid]

Google Now takes the user's voice into account during setup and usually responds only to the user's voice. Such a system should have been implemented in Echo too.

[gene-h]

Entertainingly, Alexa supports purchasing music, so one could release a song on Amazon music with audio that triggers Alexa to buy it.

[samstave]

"Alexa, cancel my health insurance"

"Alexa, call 911 to this address"

"Alexa, delete all my photos. Yes confirmed"

[newobj]

confused robo deputy

[eddieroger]

What's really great about this is that it's a joke on the future that's been predicted so many times already, my favorite of which being the last vignette on Disney's Carousel of Progress. The future family is talking about points in a video game, and the oven hears it and turns the temperature way up, ruining another family Christmas dinner - the joke being that this convenience was finally going to make Dad able to not ruin dinner.

[jandrese]

I remember this joke going way back to the DOS days. The story goes that a developer was demoing his new voice control system for the computer when from the back of the room a voice shouted "FORMAT C COLON", followed by another voice shouting "YES".

[ljk]

30 Rock also did something similar!

[userbinator]

Somewhat related story: me and some coworkers were talking in a room where someone had a Windows 10 laptop being used to present some data. We were talking as usual when the laptop suddenly decides to open a browser to a Bing search with what looked like a few (badly) voice-recognised words of our conversation. That was a rather awkward moment, given that we were discussing some extremely confidential information, and not helped by the "did someone say 'Hey Cortana'?" the laptop's owner promptly blurted out. If I remember correctly, none of us said anything that sounded remotely like that phrase, yet it activated.

It's now company policy that built-in microphones have to be disabled, and only external ones are allowed to be used when necessary.

[brebla]

Am I reading this correctly? Amazon essentially built a better integrated version of "The Clapper" https://www.youtube.com/watch?v=Ny8-G8EoWOw

[mmanfrin]

Yes, an internet connected device where you can verbally do a great many things is simply a 'better integrated Clapper'.

You sure get it.

[mmanfrin]

I think they need to pick a different name. 'Alexa' is very easy to trigger with other names, and reliably activates when I am watching any show with a character named 'Alex', 'Alexy', etc.

One side effect I've noticed is that they seem to have tried to account for it, which has made the Echo less responsive to actual requests; a few times I've stood in front of it yelling 'ALEXA' trying to get it to stop and it does not respond.

[manyxcxi]

There are three options for trigger words. There's Alexa, Amazon, and Echo.

We have ours set to Alexa (default) and when the neighbor girl comes over (Alexis) the Echo frequently wakes during conversations.

[DonHopkins]

Adolph isn't very commonly used any more.

[secabeen]

Alexa is not that easy compared to other names. Can you identify a single word that Alexa rhymes with? It's very hard to select a good wake word.

[pkamb]

Strange that she's "Alexa" to begin with. "Echo" seems like a pretty strong brand, good enough for the hardware at least, and would be a perfectly fine name for the AI as well.

[return0]

plus it really rings of "website analytics"

[minimaxir]

Interestingly, the same thing happened about 2 years ago with the Xbox One: http://www.slate.com/blogs/future_tense/2014/06/13/kinect_vo...

[CocaKoala]

At one point, I saw a video on youtube where somebody set their gamer tag on xboxlive to the phrase "Xboxturnoff", and then went around griefing players in games like Halo, where voice chat is active.

The end result was that the player would do something obnoxious, and somebody would ask them to stop, but of course this necessitates saying their gamer tag. So you'd get audio clips of people saying stuff like "Oh my god, xboxturnoff is so freaking - WAIT NO CANCEL CANCEL XBOX TURN ON".

It was pretty good stuff.

[scott_s]

This happens to me with Siri and podcasts - I listen to podcasts in my car, through my iPhone. Occasionally what people say will sound close enough to "Hey, Siri" that it stops the podcasts and and answers whatever question it could extract from the talking following what it thought was "Hey, Siri".

It's repeatable, too. One time it happened right as I was parking, on an episode of This American Life. (Or Serial. Or Planet Money. Yeah, yeah, I listen to a lot of NPR shows.) So I kept rewinding back over that part, and it kept triggering Siri.

[mattbeckman]

I believe it was This American Life, as I came here to write the same post you did. I had my iPhone mounted to an external speaker at the time, which triggered Siri, so we're probably referring to the same episode.

[userbinator]

A word that comes to mind for possibly being close enough --- if said in the right manner --- is "history", and not an uncommon word either.

[chatmasta]

"Alexa" also responds to her own commercials. [0] [1]

[0] https://www.reddit.com/r/amazonecho/comments/3oxi7b/commerci...

[1] http://motherboard.vice.com/read/people-are-complaining-that...

[kozukumi]

I seem to recall Xbox One with Kinect and its voice commands doing the same :)

[stronglikedan]

I'm pretty sure that they updated her to ignore those. At least, mine doesn't seem to respond to them anymore. She lights up blue to listen, but then goes back to sleep without action. Could be a mere coincidence though, but she still responds to other things on the TV (like Alexi's name from House of Cards). It was like a dad joke: funny at first, but annoying after a while.

[chucksmash]

Sometimes when you try to recognize speech you wreck a nice beach.

[tlrobinson]

I, for one, am looking forward to the day Alexa, Siri, Cortana, and Google Now can hold full conversations with each other.

[cronjobber]

There's an old, old movie about that:

http://www.imdb.com/title/tt0064177

"Forbin is the designer of an incredibly sophisticated computer that will run all of America's nuclear defenses. Shortly after being turned on, it detects the existence of Guardian, the Soviet counterpart, previously unknown to US Planners. Both computers insist that they be linked, and after taking safeguards to preserve confidential material, each side agrees to allow it..."

[mrbill]

I had the wake-word on mine set to "Amazon" and then made the mistake of watching an online training video for AWS....

Had to stop it and change the wake word back to "Alexa".

[dredmorbius]

I see a tremendous future in direct-to-voice-response advertising. Particularly for purchase-capable systems.

[gh02t]

Ugh, if it gets out of hand I hope the FCC/congress step in to ban it like how they require commercials to not be excessively louder than the rest of the program. I can remember how awful and widespread this was in the 90's and the subsequent rise of televisions that have built in volume filters, followed by the actual ban of it a few years ago.

Seems like a very similar sort of abuse, except potentially much more dangerous ("Alexa, order me 500 Shamwow's!"). I doubt a ban would eliminate it, but it'd definitely get rid of most.

[sxates]

I had something similar happen watching Battlestar Galactica on my Xbox and Kinect a few years back.

The show went through the opening sequence, then announced "Previously on Battlestar Galactica" at which point the xbox rewound back to the beginning of the show.

[zanok]

It reminds me of the Toyota radio ad that would place iOS into airplane mode.

https://news.ycombinator.com/item?id=9869797

[beedogs]

I guess I must be from the wrong generation, because none of these voice-activated products make any sense to me whatsoever. I really just can't see the point.

[erkkie]

My main usage of "Ok Google" is to add reminders/calendar events while driving, often after phone-calls.

[joeblau]

I had a pretty funny story a few months ago. I was watching San Andreas and there is one part where Paul Giamatti (Dr. Lawrence Hayes) yells "ALEXI..." and sure enough Amazon Echo turns on. I had to stop the movie and turn the Echo off because the it subsequently tired to process everything the movie was saying after the trigger word.

[jkot]

That is a serious security issue, many apps and webpages have permission to use speaker.

[mirimir]

It's far worse than that. Devices talk to each other at ultrasonic frequencies, telling each other what you're doing. Cross-device tracking. Plus they all hear what you say. So much for privacy ;)

[grogenaut]

I was on a PS4 launch title. We seriously considered writing things like "Xbox Off" into the script. Also that "Alexa buy me a motorcycle" commercial supposedly triggers it all the time.

[yorwba]

For most voice control applications, trigger words are enough to reliably detect owner intent, but it seems Echo needs a better mechanism. Maybe adding cameras and looking for eye contact would work?

[pbhjpbhj]

Wouldn't that kill part of the purpose if you had to eyeball the thing to give it voice commands.

Better might be to learn the location of audio producing devices (TV, radio, stereo, etc. [it tracks sound origin with multiple mics right?]) and track whether the command came from that direction and use that as a Bayesian factor for whether to trust the voice as being a user?

[nialv7]

I don't understand why would anyone think having a remote control system without any form of encryption or authentication is a good idea.

[sp332]

You get an email confirmation for every transaction and you can cancel, challenge, or return nearly anything.

[MikeTLive]

listening to XM radio, they frequently have station identification announcements.

"Siri us xm..."

with the iphone plugged in to charge while driving to work hilarity ensues as it cuts out the audio to speak of whatever it thinks was asked.

[sandra_saltlake]

That is a serious security issue

[ljk]

Wow 30 Rock predicted the future!