Understanding Privacy and Security Implications of Emerging ASR Devices

Abstract

The number of devices that use voice assistants has increased dramatically worldwide, reaching 4.2 billion in 2022 and is predicted to reach 8.4 billion by 2024. Voice assistants can interact with users through voice, perform specific tasks, and gradually learn and adapt to the user's habits. However, as voice assistants have grown in popularity, user privacy and security issues have become increasingly prominent. Topics such as misrecognition, potential eavesdropping, and waking up with hidden commands have attracted public attention. In this thesis, we propose an innovative method, SpyLoc, to locate widely used spying Automatic Speech Recognition (ASR) devices (e.g., Amazon Alexa, Apple Siri, and Google Assistant) to mitigate the potential surveillance risk. SpyLoc uses Text-to-Speech (TTS) to generate wake words, and plays them at different positions with varying volumes to trigger the target hidden ASR. By analyzing the resultant wireless traffic generated by the ASR, we calculate the corresponding distances between the wake word player and the ASR. With spatial analysis, we can further pinpoint the location of the ASR. Our extensive real-world experiments using the developed application and three commercial off-the-shelf voice assistants show that SpyLoc can achieve low localization error with a short processing time (i.e., several minutes). This method presents an innovative approach to addressing the potential eavesdropping risks posed by ubiquitous voice assistants.