Are Voice Assistants Like Alexa Making Your Car Less Secure?

–

Amazon’s wildly popular voice assistant, Alexa, is making her debut in several cars this year. But as seductive and convenient as many consumers have found her in the living room, Alexa could open up a Pandora’s box of potential risks in the automotive realm.

–

Numerous automakers, including BMW, Hyundai, and Ford, and telematics firms, including Inrix, are rolling out Alexa skills. With just a few spoken commands, owners can check the fuel and charge levels of their cars from their Barcaloungers.

–

Hyundai started the trend last fall, announcing that it would connect cars to Alexa via the company’s Blue Link app, enabling owners to issue commands from home, such as “Alexa, ask Blue Link to start my Santa Fe.”

–

–

Since then, Ford has added to Alexa’s skill set. Owners of 2017 Fusion Energi sedans, for example, can use their Echo or Tap, which are both Alexa devices sold by Amazon, to trigger home-to-car features, said Dave Hatton, manager of mobile applications for connected vehicles at Ford. Without rising from their beanbag chairs, drivers can start or stop their cars, unlock or lock doors, and ask for information such as fuel levels and battery range.

–

And that’s just the beginning.

–

“We want to make it something much cooler than just stopping and starting your car,” explained Brian McGarvey, senior director of business development at Inrix. So the company is integrating Alexa with its host of navigation, traffic, and app management software.

–

Indeed, the vehicular potential of Alexa looks nearly limitless, from EV power management to control over autonomous vehicles. In the future, designers expect you’ll be able to ask Alexa to summon your self-driving car from the garage to come and fetch you. There’s also the potential for coordinating smart cars and smart homes.

–

–

Technology companies continue to throw everything from smart door locks to remote-controlled Crock-Pots into the marketplace, but coordinating such gadgets has been an elusive goal—until Amazon’s Alexa came along. Consumers have embraced Alexa’s voice-activated “skills,” which are essentially preset functions. According to a recent survey by Parks Associates, 55 percent of U.S. households now would prefer to use voice controls to manage smart home and entertainment devices.

–

Could the same become true for the American automobile?

–

“Consumers already see Alexa as not only convenient but as an enjoyable way to control devices around the home,” said Kevin Kraus, director of product management at lockmaker Yale. The company recently made its Z-Wave Touchscreen Deadbolt door lock compatible with Amazon’s voice assistant. “Alexa offers more efficient and effective control,” said Kraus. Connecting it to the car and, in turn, connecting the car to the Internet of Things is the next logical step.

–

As you turn down your street, you could ask Alexa to preheat the oven, open the back door to let the dog out, and tune your Sonos smart speaker in the kitchen to the Pandora channel you’re currently listening to in the car. In the morning, while sipping your fair-trade coffee, you might ask Alexa for the quickest way to the Staples Center and have the directions automatically sent to the car. Once you’re behind the wheel, not only would the navigation engage automatically, but Alexa would remind you to pick up almond milk (based on your to-do list) and then start reading aloud the Audible book you were listening to last night.

–

Ford CEO Mark Fields (right) and Greg Hart, vice president of Amazon Echo and Alexa Voice Services, at CES 2016.

–

–

But is there a dark side to the Alexa-enabled car of the future?

–

One can just as easily imagine teenagers pranking their parents by starting the car in the middle of the night while it’s parked in the garage (creating potentially worrisome concentrations of carbon monoxide) or opening the minivan’s windows when the vehicle is parked outside in a thunderstorm.

–

Worse, like something out of a Stephen King novel, imagine eavesdropping thieves taking control of your autonomous car (“Alexa, have Christine leave the garage and pick me up at the 7-Eleven”). Without so much as breaking a window or scratching the paint, burglars could simply ask Alexa to open the doors to extract any valuables inside.

–

Although such scenarios may sound far-fetched, Alexa does not yet have built-in security features. Alexa cannot perform voiceprint analysis, for example, so it cannot tell the difference between your voice, your daughter’s voice, and that of a stranger. Theoretically, anyone within earshot of a connected Alexa Echo or Tap could trigger any skills the owner had enabled.

–

Automakers and technology firms acknowledge there are risks and have taken some initial steps to mitigate the potential for Alexa abuse. One approach is simply to limit her powers. At the BMW Group Technology Offices in Mountain View, California, Dirk Rossberg acknowledged there are security issues. So to obviate the problem, Alexa commands will be limited to a subset of what’s already enabled on BMW’s smartphone app, according to Rossberg. You will be able to lock a 2017 BMW 5-series with voice commands, for example, but not unlock it.

–

–

Yale’s Kraus similarly noted that his company isn’t giving Alexa unfettered freedom. Using a custom skill that works with smart devices, homeowners can use the voice assistant to lock Yale’s Z-Wave Touchscreen Deadbolt—but not unlock it.

–

“And someone can’t just shout from outside to your Echo and unlock your car,” said Ford’s Hatton. “You have to have a PIN, so we did build in some precautions.” And there are other existing restrictions, such as a time limit on how long a remotely started car will run before it shuts itself off.

–

Of course, mischievous family members or friends could remember your spoken PIN and still pull a prank or two. However, Hatton pointed out that such cases aren’t dissimilar to someone simply stealing your key fob.

–

Furthermore, unlike Google Voice or Siri, Alexa is not a full-fledged natural-language speech-recognition program. She only understands specific commands. Ask Alexa when the next Formula 1 race is, and she’s stymied, even though the most rudimentary search engine can deliver the answer in milliseconds. This apparent weakness of Alexa is also her strength. By limiting the skills available, it improves its accuracy in recognizing specific commands—and limits the program’s vulnerability to digital break-ins.

–

–

Nevertheless, Alexa’s skills are multiplying exponentially, with thousands already enabled. Auto companies plan to add more in the near future. Both Ford and Inrix will soon offer Alexa skills from within vehicles, for example, unleashing a whole new set of features—and associated risks.

–

By the end of the year, Hatton said, drivers will be able to access grocery lists, navigation features, and other Alexa-triggered features from within some Ford vehicles. Some parents may envision it as an invitation to obnoxious kids in the back seat, allowing tweens to wreak Alexa havoc such as messing up grocery lists, turning the lights on at home, and switching from your Metallica channel to Justin Bieber. Fortunately, that’s not likely to happen. Unlike the home version of Alexa, Ford will require you to push the talk button on the steering wheel to get Alexa to listen to you in a car.

–

Of course, any passengers in the car who overhear private codes during such exchanges could theoretically break in later, but in Ford’s case, the feature is authenticated in conjunction with the smartphone, so pranksters would have to steal your phone, too. Yet Inrix, which hopes to sell its new software features to carmakers, will enable Alexa and allow her to control apps with or without a smartphone.

–

–

Both Ford’s Hatton and Inrix’s McGarvey underscore the fact that it will take some time and consumer feedback to determine what kind of Alexa apps, such as games that keep drivers alert, might be appropriate for the car. It will also be a learning curve to figure out how secure cars need to be. And there are competing voice assistants, such as Google Assistant, which Hyundai has just announced is now available on the 2018 Sonata.

–

“It’s often a matter of convenience versus security,” said Steve Grobman, chief technology officer of McAfee, which was recently spun out of Intel. Grobman pointed out that another layer of security, such as voiceprint analysis or another biometric, could be added, but that may be unnecessary: “The next generation of cars will be a lot less self-contained and easily disabled if stolen, so what’s the incentive for a bad actor?”

–

–
• Ford Updates Sync 3, Includes Amazon Echo Integration

–

• Half Off: Chevrolet Chops Price of 4G LTE Data Subscriptions

–

• Ford Wants Cars to Talk with Smart Homes, Digital Assistants

–

–

“Ultimately, if it’s a computer connected to the outside world,” said Yoni Heilbronn, chief marketing officer of Argus Cyber Security, which works with automakers, “nothing is going to be 100 percent secure.”

–

So given the fact that cars with connected systems are already online, the cat may already be out of the bag—with or without Alexa.

–

Car and Driver BlogCar and Driver Blog