  We present Alexa versus Alexa (AvA), a novel attack that leverages audio
files containing voice commands and audio reproduction methods in an offensive
fashion, to gain control of Amazon Echo devices for a prolonged amount of time.
AvA leverages the fact that Alexa running on an Echo device correctly
interprets voice commands originated from audio files even when they are played
by the device itself -- i.e., it leverages a command self-issue vulnerability.
Hence, AvA removes the necessity of having a rogue speaker in proximity of the
victim's Echo, a constraint that many attacks share. With AvA, an attacker can
self-issue any permissible command to Echo, controlling it on behalf of the
legitimate user. We have verified that, via AvA, attackers can control smart
appliances within the household, buy unwanted items, tamper linked calendars
and eavesdrop on the user. We also discovered two additional Echo
vulnerabilities, which we call Full Volume and Break Tag Chain. The Full Volume
increases the self-issue command recognition rate, by doubling it on average,
hence allowing attackers to perform additional self-issue commands. Break Tag
Chain increases the time a skill can run without user interaction, from eight
seconds to more than one hour, hence enabling attackers to setup realistic
social engineering scenarios. By exploiting these vulnerabilities, the
adversary can self-issue commands that are correctly executed 99% of the times
and can keep control of the device for a prolonged amount of time. We reported
these vulnerabilities to Amazon via their vulnerability research program, who
rated them with a Medium severity score. Finally, to assess limitations of AvA
on a larger scale, we provide the results of a survey performed on a study
group of 18 users, and we show that most of the limitations against AvA are
hardly used in practice.
