It's interesting this malware uses DNS over HTTPS to avoid detection.

The first, according to Cisco Talos: https://twitter.com/infosec_nick/status/1146069799899938816

It doesn't. At least not in the "DNS over HTTPS - the protocol specified in an RFC" sense: https://twitter.com/bagder/status/1146740062127886338

The best way to prevent abuse is not separating children from their families. In Canada, when the government separated indigenous children from their families through sixties scoop and residential schools, the children suffered tremendous abuse by the teachers and staff members.

The separation policy needs to change.

'Samsung itself is aware of these risks. In its privacy policy, the company warned customers to be aware that "if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition." The language reminded some of the George Orwell classic dystopian novel 1984.'

>It's just a statement of how all voice recognition currently works.

Amazon has said on numerous occasions that no data transfer occurs without a trigger word hitting the mic -- a feature that was a main point when discussing the safety of having an always-on internet-connected mic in the house.

As for whether or not they're telling the truth, I don't know; but trigger-words have always been a feature that Amazon loved mentioning from a security/privacy standpoint.

> As for whether or not they're telling the truth, I don't know;

Luckily it's possible to check [0]! Although it gets a bit more complicated and can change, my understanding is that currently most people observe it increase it's network usage after it's trigger phrase, but not at other times (it uses the network for other stuff too, but audio data is typically rather large in comparison).

[0] https://www.iot-tests.org/2017/06/careless-whisper-does-amaz...

[1] 10.1007/s00779-018-1174-x <- Might want to use sci-hub

The pessimist in me think that a determined actor could simply capture non-trigger voice data offline, and bundle it with the rest of the traffic whenever the next trigger word occurs. But I am talking out my ass and have in no way verified any of this

It does seem to me like Amazon worded that statement very carefully, and in a way that allowed for that kind of behavior to occur.

Conversely, if they were not doing that kind of thing, they could have removed that ambiguity from what they said.

This was my thought too; there doesn't seem to be a way to verify this isn't happening.

If data is being buffered and only sent after the trigger words wouldn't the data transmitted vary depending on how much was said before the trigger word?

Maybe. All uploads could be padded with the maximum buffer size so you can't tell the difference. The buffer could flush only small amounts at a time. Some compression algorithm could be used that becomes more efficient with larger recordings.

What you should be asking with any "smart" device is "can I prove this device will do no harm to me".

Honestly I have never understood the value proposition of any smart device. Why would I want any of that functionality? Never once in my life have I ever wanted to talk to my TV. I'm beginning to (again) question the wisdom of carrying a smartphone.

Also see this Amazon patent related to intentionally removing PII from speech transmitted to the cloud.

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...

In case the link doesn't work, it's US Patent 9922646.

Did you link the right patent? That claim is only for locating a user in a room based on multi-room voice input.

Grrr - wrong link:

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=H...

Yes of course. I don't get why that affects the privacy policy though. There are occasional false positives and you still might say something sensitive after the trigger word.

I’ve heard that the Echo’s mute button is a hardware off switch for the mic, though for obvious reasons you probably wouldn’t leave it on most of the time.

iOS can do voice recognition processing entirely locally for many languages. I’m sure the same is true for Android.

Google has made strides in local-only translation. I can't seem to find the Hacker News article but believe it was wired into the Google keyboard iirc.

It's interesting that Japan also has a conviction rate that exceeds 99%, and Canada has a conviction rate of 97%.

That Canadian man smuggled 200 kilos(440 pounds) of meth into China. If he did that in Singapore or Japan, he would get death penalty too.

"The U.S. State Department is now requiring nearly all applicants for U.S. visas to submit their social media usernames, previous email addresses and phone numbers. It's a vast expansion of the Trump administration's enhanced screening of potential immigrants and visitors."

Does freedom of speech only apply to Americans? Can foreigners get penalized and denied entry for what they say on social media?

Freedom of speech is certainly not universal today and depends on the laws of a country.

It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor?

Backdoor definition: "A backdoor is a method, often secret, of bypassing normal authentication in a computer system."

People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.

> Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.

That someone might not be the company, it might be a developer.

It's entirely true that the company says it's not a backdoor, the developer says it's a mistake, but he/she was approached from an external organization.

Unless you can provide either way it's impossible to classify it as a backdoor or not.

> People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

And considering you can never know if someone else knows about it, that means you can never know if it was a backdoor.

And what do you think this was? Virtually all router/networking devices have some kind of "hardcoded account" (read:backdoor) and this is only slowly changing. I believe the EU is going to ban the practice soon.

If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.

This is exactly why I only buy belkin routers. I can't even connect to it.

Ha! Thanks for making me laugh out loud.

Without wanting to start a political flame war it would be great if there was consistency to how we in the tech community and the media treat these types of vulnerabilities. When Huawei have these sorts of bugs they are reported as backdoors. Bugs happen in software be nice if put the nationalism aside and reported it consistently as bugs or vulnerabilities

Nexus 9000, running ACI, not normal NX-OS, as opposed to the ASR 9000 series which are common internet routers.

Cisco model numbers are fun.

god I still have nightmares about cisco sales rep trying to push ACI as the "solution to all problems".

Also you should have ACLs in place and VLAN segmentation (assuming their use as pure layer 2 devices) so that only certain authorized sections of the network are even able to reach things like the management ssh and SNMP daemons.

Or turn that all that shit off and go full Out of Band management - ok there are some trade-offs here.

'unauthenticated' should have been in the title of this post

Given that it is a $30k+ piece of kit I suspect not too many people here have them.

"We have no real (at least not this in depth) assurance that products from rival vendors are more secure"

It should be a requirement to similarly audit every supplier. Cisco has a history of backdoors and serious bugs.

Click on his profile. He's the CTO of the company.