  Virtual personal assistants (VPA) (e.g., Amazon Alexa and Google Assistant)
today mostly rely on the voice channel to communicate with their users, which
however is known to be vulnerable, lacking proper authentication. The rapid
growth of VPA skill markets opens a new attack avenue, potentially allowing a
remote adversary to publish attack skills to attack a large number of VPA users
through popular IoT devices such as Amazon Echo and Google Home. In this paper,
we report a study that concludes such remote, large-scale attacks are indeed
realistic. More specifically, we implemented two new attacks: voice squatting
in which the adversary exploits the way a skill is invoked (e.g., "open capital
one"), using a malicious skill with similarly pronounced name (e.g., "capital
won") or paraphrased name (e.g., "capital one please") to hijack the voice
command meant for a different skill, and voice masquerading in which a
malicious skill impersonates the VPA service or a legitimate skill to steal the
user's data or eavesdrop on her conversations. These attacks aim at the way
VPAs work or the user's mis-conceptions about their functionalities, and are
found to pose a realistic threat by our experiments (including user studies and
real-world deployments) on Amazon Echo and Google Home. The significance of our
findings have already been acknowledged by Amazon and Google, and further
evidenced by the risky skills discovered on Alexa and Google markets by the new
detection systems we built. We further developed techniques for automatic
detection of these attacks, which already capture real-world skills likely to
pose such threats.
