I am reading this note from ESET Latin America where they warn users that we have Amazon Echo and Amazon Kindle E-Readers are vunerable to Key Reinstallation Attack (Known as KRAK).
It is associated with WPA2 wireless networks, the immediate effect is associated with spy on the network traffic of the user who manipulates these devices. More details below
ESET DISCOVER THAT AMAZON ECHO AND KINDLE ARE VULNERABLE TO KRACK ATTACKS
Researchers at the IT security company, ESET Latin America, discovered versions of Echo and Kindle vulnerable to KRACK, a vulnerability in the WPA2 Wi-Fi network security protocol
Smart Home Research Team of ESET, a leading proactive threat detection company, discovered that Amazon Echo (the original Amazon Alexa hardware) was vulnerable to an attack known as KRACK (Key Reinstallation Attack). It was also discovered in at least one generation of electronic readers known as e-readers, Amazon Kindle. All identified bugs were reported by ESET to the Amazon security team and were subsequently patched.
In 2017, two Belgian researchers announced the finding of weaknesses in the WPA2 standard, a protocol that at that time ensured virtually all modern Wi-Fi networks. In their paper, they describe that an attacker could trick a victim device into resetting the pairwise key used in the current session.
By exploiting this fault, an attacker would be able to gradually rebuild the XOR encryption stream and then spy on the victim's network traffic. “Even two years later, many Wi-Fi enabled devices remain vulnerable to KRACK attacks.
As demonstrated by the ESET Smart Home Research Team, this included multiple Amazon devices, which given its massiveness represents a powerful security risk. ”Said Camilo Gutierrez, Head of the Research Laboratory of ESET Latin America.
As part of ESET's research, the first generation of Amazon Echo (original Amazon Alexa hardware) and the eighth generation of Amazon Kindle were analyzed. The experiments focused mainly on the resistance of the devices against KRACK using the scripts available by the Vanhoef team. Thus it was discovered that both were vulnerable to two KRACK vulnerabilities.
These vulnerabilities are quite serious, as they allow an attacker:
retransmit old packets to execute a DoS attack, interrupt network communication or perform a replay attack; decipher any data or information transmitted by the victim; depending on the network configuration: falsify data packets, cause the device to discard packets or even inject new packets;
Intercept confidential information such as passwords or session cookies.
The ESET research team informed Amazon about all the vulnerabilities identified in Echo and Kindle and received confirmation that Amazon's security team had responded to the reported problems, prepared patches and would be distributing them to users.
ESET notes that KRACK attacks, similar to any other attack against Wi-Fi networks, require close proximity to be effective. This means that the attacker and the victim's devices must be within range of the same Wi-Fi network for the engagement to take place.
“The exploits described affect only the security of WPA / WPA2. If successful, the effect would be similar to the victim using an unprotected Wi-Fi network. We recommend that all Amazon users verify, through the Echo application and the Kindle configuration, that in both cases they are using the latest Echo and Kindle firmware. ”, Concluded Camilo Gutierrez.