Alexa, What Happened to My Car?

Amazon’s Alexa voice-controlled virtual assistant is the Chatty Cathy of the tech world, a digital darling that consumers can’t get enough of. It can tell chicken jokes, order pizza and turn off the kitchen faucet. So it’s not surprising that Alexa has made the leap from the home to the car.

But just as Alexa promises added hands-free convenience for drivers, researchers and engineers warn that it also opens new avenues for hacking, tracking and sonic attacks. Depending on how voice-activated assistants are connected, such hacks could range from annoying pranks like opening a car’s windows in the rain to dangerous attacks like remotely unlocking a house’s doors for a robbery.

“As we make everything smarter and more connected,” said Nadir Izrael, chief technology officer of the internet security firm Armis, “we end up creating a huge attack surface on devices, like cars, that weren’t intended.”

Last year, Armis discovered one such vulnerability — known as BlueBorne — that exposed billions of connected devices, including Amazon’s Echo and Google’s Home smart speakers, to the possibility of being hijacked by hackers. Cars with Bluetooth were also vulnerable.

Cars are a highly lucrative target, said Yoni Heilbronn, chief marketing officer at Argus Cyber Security, which the automotive systems supplier Continental recently acquired. “People are inside these vehicles moving at high speeds, and cars cost a significant amount of money. So how many bitcoins would you pay a ransomware hacker?”

Navigation systems already recognize — often imperfectly — drivers’ voices, and many cars have their own speech-recognition features. Connect a smartphone to a car’s infotainment system, and a driver can have access to features including Apple’s Siri or Google’s Assistant.

But in those cases, voice commands are limited. They can’t remotely start a car or open its windows. Siri can’t even change the radio station.

Alexa, on the other hand, is intended — via specific, preprogrammed commands — to interact with thousands of connected devices, performing tasks like turning on lights, opening door locks, disabling home security systems or even ordering a year’s supply of toilet paper. And it’s already connecting living rooms to cars.

Automakers ranging from BMW, Ford, Hyundai and Nissan to startups like Byton have tapped into Alexa’s appeal. Although voice assistants are increasingly becoming intertwined with new models, including those from Mercedes-Benz and Toyota, most current Alexa car skills are strictly one-way, from the home to the car, and use existing automotive smartphone applications.

“Alexa piggybacks on our app,” said Denise Barfuss, a senior manager for connected services at Nissan. “So if it’s 25 degrees outside, you can just tell Alexa to start the car” from inside your house to warm it up, she said.

Simple Alexa commands can flash the lights or honk the horn, Barfuss said, but remote instructions that alter the state of the car — such as locking the doors and starting the engine — also require a spoken PIN code.

And even though voice bots like Alexa and Google’s Assistant can be taught to recognize different voices — well enough to cater to each family member’s favored Pandora stations, for example — they do not offer any sort of biometric security, such as voice print analysis. As a result, Alexa’s voice-recognition capabilities are not discerning enough for security purposes, according to Amazon. (A company spokesman noted, however, that Amazon had special teams dedicated to continually reviewing and updating the security of its software.)

Without such measures, anyone who eavesdropped on a spoken PIN command could use it to start and unlock a vehicle, leaving a victim to ask, “Alexa, what happened to my car?” Security experts are also concerned about more sophisticated cyberattacks involving voice assistants.

“There are synthetic voice sound clips,” said Gang Wang, assistant professor at Virginia Tech’s College of Engineering. “It sounds like random noise to us, but to the machine it sounds like a specific command.” So a seemingly innocuous sound, like an explosion in a YouTube video played on a nearby TV or tablet, could contain secret instructions.

Other hacks have included ultrasonic commands that are beyond the range of human hearing but understood by voice bots. And even if they do establish biometric security features, Wang said, regenerative machine learning could use a recording of a person’s voice to synthesize new commands that could fool them.

The safety and security concerns become more challenging when tools like Alexa are used to make car-to-home connections. While cruising down the interstate, a driver can open a garage door back at home or shut off the living room lights, for example. Ford already offers such car-to-home capabilities that, using its Ford+Alexa app, can tap into some 25,000 Alexa skills in vehicles that have the company’s Sync 3 in-dash system. Ford has also added a new feature that allows the driver to forgo the push-to-talk button and trigger Alexa by uttering a wake-up phrase.

Such convenience does allow for the possibility that restive children could prank Alexa from the back seat simply by calling out for, say, Rick Astley songs. Timur Pulathaneli, Ford’s supervisor of connected vehicles and services, said that if it proved to be a nuisance, drivers could turn the feature off in the app so that Alexa would respond only after a button was pushed on the steering wheel.

Ford’s setup also limits what a car thief or a parking attendant can do behind the wheel. A person wouldn’t automatically be able to unlock a home’s front door from the car because such functions work only in conjunction with the owner’s smartphone (which they’d have to steal, too).

Adding voice assistants to vehicles may make cars seem like just another device on the so-called Internet of Things, but it raises the stakes significantly.

“What gets added with the car is your specific location,” Wang said. “You can track where the car goes and at what times.”

If compromised, Alexa could provide a criminal with details about a user’s purchases, driving habits and travel routines. And to make it easier to connect different smart devices, Alexa regularly scans for compatible gadgets. All that information is sent back to Amazon’s servers and then shared with other companies, Travis Witteveen, chief executive of the security firm Avira, pointed out. The sharing of such information increases the system’s — and the car’s — security vulnerabilities.

Nevertheless, the conveniences that digital assistants offer may make them an ineluctable part of the next generation of cars. Nuance, a leading speech-recognition company involved in the automotive business, is already working on voice systems for cars that would be even easier to use. Eric Montague, Nuance’s senior director of product marketing and strategy, said the company would introduce a system this year that did not require the driver to use a wake-up word or push a button to talk.

Ultimately, the car will simply understand when it’s being spoken to.

“People will expect to be able to have a conversation with their car,” said Martyn Humphries, a vice president at NXP, whose sensors are used extensively in automotive applications. “So security is going to have to continue to evolve with it.”