Skip to main content
SpringerLink
Log in

Exploring Vulnerabilities in Voice Command Skills for Connected Vehicles

  • Conference paper
  • First Online:
Security and Privacy in Cyber-Physical Systems and Smart Vehicles (SmartSP 2023)

  • 122 Accesses

Abstract

Voice assistant platforms have revolutionized user interactions with connected vehicles, providing the convenience of controlling them through simple voice commands. However, this innovation also brings about significant cyber-risks to voice-controlled vehicles. This paper presents a novel attack that showcases the ability of a “malicious” skill, utilizing the skill ranking system on the Alexa platform, to hijack voice commands originally intended for a benign third-party connected vehicle skill. Through our evaluation, we demonstrate the effectiveness of this attack by successfully hijacking commonly used commands in commercial connected vehicle skills.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 49.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 64.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Alexa: The scalable neural architecture behind alexa’s ability to select skills. https://www.amazon.science/blog/the-scalable-neural-architecture-behind-alexas-ability-to-select-skills/

  2. Amazon: Authorization controller interface. https://developer.amazon.com/en-US/docs/alexa/automotive/alexa-authorizationcontroller.html/

  3. Amazon: Connected car skills market. https://www.amazon.com/s?k=vehicle &i=alexa-skills/

  4. Amazon: Connected vehicle overview. https://developer.amazon.com/en-US/docs/alexa/automotive/connected-vehicle-overview.html/

  5. Amazon: Connected vehicle skills for alexa. https://developer.amazon.com/en-US/docs/alexa/automotive/connected-vehicle-overview.html/

  6. Cheng, L., Wilson, C., Liao, S., Young, J., Dong, D., Hu, H.: Dangerous skills got certified: Measuring the trustworthiness of skill certification in voice personal assistant platforms. In: ACM SIGSAC Conference on Computer and Communications Security (CCS) (2020)

    Google Scholar 

  7. Compustar: Cs4900-s remote start. https://www.compustar.com/bundles/cs4900-s/

  8. Edu, J., Ferrer-Aran, X., Such, J., Suarez-Tangil, G.: Measuring alexa skill privacy practices across three years. In: Proceedings of the ACM Web Conference (WWW), p. 670–680 (2022)

    Google Scholar 

  9. Esposito, S., Sgandurra, D., Bella, G.: Alexa versus alexa: controlling smart speakers by self-issuing voice commands. arXiv preprint arXiv:2202.08619 (2022)

  10. Kim, Y.B., Kim, D., Kumar, A., Sarikaya, R.: Efficient large-scale neural domain classification with personalized attention. In: Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 2214–2224 (2018)

    Google Scholar 

  11. Kumar, D., Paccagnella, R., Murley, P., Hennenfent, E., Mason, J., Bates, A., Bailey, M.: Skill Squatting Attacks on Amazon Alexa. In: 27th USENIX Security Symposium (USENIX Security). pp. 33–47 (2018)

    Google Scholar 

  12. Lentzsch, C., Shah, S.J., Andow, B., Degeling, M., Das, A., Enck, W.: Hey Alexa, is this skill safe? taking a closer look at the Alexa skill ecosystem. In: Proceedings of the 28th ISOC Annual Network and Distributed Systems Symposium (NDSS) (2021)

    Google Scholar 

  13. Lentzsch, C., Shah, S.J., Andow, B., Degeling, M., Das, A., Enck, W.: Hey Alexa, is this skill safe? taking a closer look at the Alexa skill ecosystem. In: 28th Annual Network and Distributed System Security Symposium, NDSS (2021)

    Google Scholar 

  14. Seminatore, M.: Alexa tesla. https://github.com/mseminatore/alexa-tesla/

  15. Wang, D., Chen, K., Wang, W.: Demystifying the vetting process of voice-controlled skills on markets. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 5(3), 1–28 (2021)

    Google Scholar 

  16. Zhang, N., Mi, X., Feng, X., Wang, X., Tian, Y., Qian, F.: Dangerous skills: understanding and mitigating security risks of voice-controlled third-party functions on virtual personal assistant systems. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 1381–1396 (2019). https://doi.org/10.1109/SP.2019.00016

  17. Zhang, Y., Xu, L., Mendoza, A., Yang, G., Chinprutthiwong, P., Gu, G.: Life after speech recognition: fuzzing semantic misinterpretation for voice assistant applications. In: Network and Distributed System Security Symposium (NDSS) (2019)

    Google Scholar 

Download references

Acknowledgment

This material is based upon work supported in part by the National Science Foundation (NSF) under Grant No. 2239605, 2129164, 2228617, 2120369, 2226339, and 2037798.

Author information

Authors and Affiliations

  1. University at Buffalo, Buffalo, NY, USA

    Wenbo Ding, Keyan Guo, Ziming Zhao & Hongxin Hu

  2. Clemson University, Clemson, SC, USA

    Song Liao, Fuqiang Zhang & Long Cheng

Authors
  1. Wenbo Ding
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Song Liao
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Keyan Guo
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Fuqiang Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Long Cheng
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Ziming Zhao
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Hongxin Hu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Hongxin Hu .

Editor information

Editors and Affiliations

  1. Binghamton University, Binghamton, NY, USA

    Yu Chen

  2. National Taiwan University, Taipei, Taiwan

    Chung-Wei Lin

  3. Michigan Technological University, Houghton, MI, USA

    Bo Chen

  4. Northwestern University, Evanston, IL, USA

    Qi Zhu

Rights and permissions

Reprints and permissions

Copyright information

© 2024 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Ding, W. et al. (2024). Exploring Vulnerabilities in Voice Command Skills for Connected Vehicles. In: Chen, Y., Lin, CW., Chen, B., Zhu, Q. (eds) Security and Privacy in Cyber-Physical Systems and Smart Vehicles. SmartSP 2023. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 552. Springer, Cham. https://doi.org/10.1007/978-3-031-51630-6_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-51630-6_1

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-51629-0

  • Online ISBN: 978-3-031-51630-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation