  This paper investigates the privacy leakage of smart speakers under an
encrypted traffic analysis attack, referred to as voice command fingerprinting.
In this attack, an adversary can eavesdrop both outgoing and incoming encrypted
voice traffic of a smart speaker, and infers which voice command a user says
over encrypted traffic. We first built an automatic voice traffic collection
tool and collected two large-scale datasets on two smart speakers, Amazon Echo
and Google Home. Then, we implemented proof-of-concept attacks by leveraging
deep learning. Our experimental results over the two datasets indicate
disturbing privacy concerns. Specifically, compared to 1% accuracy with random
guess, our attacks can correctly infer voice commands over encrypted traffic
with 92.89\% accuracy on Amazon Echo. Despite variances that human voices may
cause on outgoing traffic, our proof-of-concept attacks remain effective even
only leveraging incoming traffic (i.e., the traffic from the server). This is
because the AI-based voice services running on the server side response
commands in the same voice and with a deterministic or predictable manner in
text, which leaves distinguishable pattern over encrypted traffic. We also
built a proof-of-concept defense to obfuscate encrypted traffic. Our results
show that the defense can effectively mitigate attack accuracy on Amazon Echo
to 32.18%.
