## 9 Discussion
### CASE STUDY: Security Vulnerability of Alexa (Especial Focus on Authentication)  
In this vulnerability study an Alexa system as shown in Figure 8 is considered. As reported in [74], the Alexa security bug allows hackers to access the recorded voice history of a user. It has also recently been reported that there is a potential risk of user information and contact list information exposure, if any third-party skills from the Alexa skills market platform are installed, as revealed in [75]. In another incident, as reported by an independent news report, as described in [76], a user found Alexa's recordings of her voice and all her phone sync information, including the location information of the device, through Amazon. This shows that the syncing of [PERSON] with a phone and the cloud could potentially allow Amazon to collect personal information, and unless the user knows how to fine-tune their security settings, the possibility of leaking private information increases. In the following section, the security weakness of an Alexa system is discussed, to understand its loopholes and reveal the vulnerabilities in an interactive multimodal robotic system:  
Alexa: The system does not record or go live until a wake word is used. Therefore, it seems to be protected, and in fact, the wake word is further processed at the cloud server to verify the wake-up call. It also has an inbuilt mechanism to show when it is recording, because a light indicator or audible tone will sound. Moreover, the mic or camera can also be disconnected, then it will stop listening and recording the query. Thus, many features are added to protect users' privacy and maintain data security. However, the following issues and challenges are not addressed by this advanced echo system [77].  
* The system may wake up if the wake-up word is used during a conversation, without having the intention to wake up [PERSON].
* If the sound of a word is similar to the wake-up word, it may still detect it as a wake-up signal.
* The system may not be recording, but it is listening; otherwise, how would the system detect a wake-up word or phrase? There is a provision to manage and control the voice recording; however, how many times and how often, would someone check if a recording was made accidentally or on purpose. Unless this is checked and managed regularly, sensitive information and data might be recorded by the system.
* Once the system is live, the system has no idea of who can access or query. It does not monitor what is appropriate to age, situations, and scenarios. It will provide the service to anyone.  
Figure 8: Alexa ([[https://www.amazon.co.uk/](https://www.amazon.co.uk/)]([https://www.amazon.co.uk/](https://www.amazon.co.uk/)) (accessed on 11 October 2021)).  
Anyone can wake up the system, simply by knowing the authenticating word, it means that anyone who can speak, can activate the system. Since the sound of a word is used to activate the process, the authentication mechanism is very insecure, mainly because it is easy and anyone within an audible vicinity can hear the code. If a voice recognition system is included, to detect and authorise the users, then knowing the sound of the passcode will not activate the service, unless the user is authorised and validated through a voice recognition authentication process. - The system has a mechanism to recall and reread the past recoded data from the system, so anyone can listen to past recorded queries if they know the wake-up word. This is very inappropriate, as it easily leaks private and sensitive information. Medical records and problems, legal issues, and private choices including financial status and records could be leaked.  
Thus, the existing privacy mechanism in place is neither effective nor efficient in managing and controlling user data and the way the user interacts with Alexa.