Researchers from London’s Royal Holloway University and the University of Catania have discovered multiple exploits that take control of the smart speaker Amazon Echo. In a technical paper, the researchers explain how they successfully chained together three (3) vulnerabilities to allow persistent access into the device. The first exploit they utilized involved setting up a malicious “radio skill”, a program that can be loaded onto the Alexa to edit the voice assistant’s responses. Using the skill, the researchers were able to intercept incoming commands and modify the results, acting as a man-in-the-middle (MITM) attack. This would allow them to, for example, order items off of Amazon using the victims account or control smart home devices. The researchers had an issue with the skill though, as it would only stay active for one hour before stopping. To combat this, they discovered a second exploit that allowed them to reissue the skill command by using Echo itself. The researchers found they were able to issue commands through the device itself by playing an audio file through the speaker. Using this exploit, they can keep a persistent MITM attack running on the device at all times. Another issue presented itself with the discovery of this vulnerability, the device would attempt to turn the volume of the audio file down once it heard its wake word. The researchers easily combatted this by using the command “Echo, go on” that would keep the volume at 100%. These attacks against voice assistant devices require prior setup from the attacker, either by downloading a malicious skill or through pairing a Bluetooth-enabled device. While this attack may not be used in the wild for quite some time, these researchers have shown the smart speakers we keep in our homes enable another vector for cyber-attacks.