Injecting audio into an Amazon Echo Dot - Page 1
Forum section: electronics / projects

author: MattHollands
author_rank: Frequent Contributor
timestamp: September 13, 2017, 03:20:00 pm
content: Hi!I had the idea a while ago to see if you could inject audio into an Amazon Echo Dot via the power supply, allowing you to issue voice commands silently. This kind of attack perhaps could be used as a way of breaking into houses where the door locks are controlled by your voice assistant (a pretty dumb idea, but yeah), or just to play pranks. It would also require access to the device to replace the power supply with your own modified one that issues commands at a later time.I messed around with the idea, and it looks like the audio signal isn't managing to make its way through to the microphones, but it was an interesting test. I thought that perhaps you could sneak the signal passed some LDOs by lowering the DC supply voltage to the dropout voltage before adding the audio signal, therefore when the voltage drops below the dropout voltage the output would too, and you could effectively get half the audio wave on the power supply to the microphones. Then I thought maybe if the device managed to stay on, this would manifest as an audio signal going into the device. In reality it turns out the the device drops out at around 4.2V. Obviously, if they're using any kind of SMPS it would destroy the audio signal anyway.All of this was speculation but I thought it would be a cool thing to try so if you're interested:projects.matthollands.com/2017/09/11/amazon-echo-dot-attempts-at-a-power-line-attack/I can't find any detailed schematics or teardowns of the Echo Dot online, so maybe I'll do one myself, although I don't really want to break mine and it looks like it might be a pain to open. If anyone has any ideas how this might be made to work, let me know!

author: DBecker
author_rank: Frequent Contributor
timestamp: September 13, 2017, 03:52:48 pm
content: This seems extremely unlikely to work.The Dot is powered by 5V over USB. The processor core likely runs around 1.1V. In between there are one or two switching supplies (the PMIC powering the Dot has four switching converters and 8 LDO outputs) and, I believe, an on-die linear regulator. The brown out interrupt will shut everything down long before you can couple significant audio frequency signals there.Perhaps you are thinking that you'll influence the peripheral connections that run at 1.8V, injecting the sounds directly into analog parts of the many microphones. A starting point for researching that challenge is checking out the high effective PSRR of the seven MEMS microphones that directly output PCM.This may be a case where I just know too much to "think outside the box". On the other hand, knowing what's in the box avoids many of the uncountable different approaches that can't possibly work.

author: MattHollands
author_rank: Frequent Contributor
timestamp: September 13, 2017, 03:58:35 pm
content: Yep I know it's unlikely. I was just interested.As you say, "The processor corelikelyruns around 1.1V", but might not. I was indeed thinking more along the lines of trying to leak into the analogue parts of the microphones.

author: senso
author_rank: Frequent Contributor
timestamp: September 13, 2017, 03:59:18 pm
content: Just shift into the ultra sound territory, and hope your "neighbour" doesn't have a dog.http://fortune.com/2017/09/08/amazon-echo-alexa-google-home-hack/

author: DBecker
author_rank: Frequent Contributor
timestamp: September 13, 2017, 04:04:10 pm
content: Quote from: MattHollands on September 13, 2017, 03:58:35 pmThe processor core uses a dynamically programmable voltage. It's likely to be constantly changing based on the workload, at least if they care about power usage. They don't need to care nearly as much as using the same processor in a mobile device, but they may be using a common code base.Pull the datasheet of a MEMS microphones that directly outputs PCM and check out the specs...