GlobeNewswire Inc | Aug 13, 2020 06:00AM EDT

August 13, 2020

SAN CARLOS, Calif., Aug. 13, 2020 (GLOBE NEWSWIRE) -- Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, recently identified security vulnerabilities in certain Amazon/Alexa subdomains that would have allowed a hacker to remove/install skills on the targeted victims Alexa account, access their voice history and personal data. The attack required a single click by the user on a malicious link crafted by the hacker and voice interaction by the victim.

With over 200 million sold globally, Alexa is capable of voice interaction, setting alerts, music playback, and controlling smart devices in a home automation system. Users can extend Alexas capabilities by installing skills. which are voice-driven apps. However, the personal information stored in users Alexa accounts and the devices use as a home automation controller makes them an attractive target for hackers.

Check Point researchers demonstrated how the vulnerabilities they found in certain Amazon/Alexa subdomains could be exploited by a hacker crafting and sending a malicious link to a target user, which appears to come from Amazon. If the user clicks the link, the attacker can then:

-- Access a victims personal information, such as banking data history, usernames, phone numbers and home address -- Extract a victims voice history with their Alexa -- Silently install skills (apps) on a users Alexa account -- View the entire skill list of an Alexa users account -- Silently remove an installed skill

Smart speakers and virtual assistants are so commonplace that its easy to overlook just how much personal data they hold, and their role in controlling other smart devices in our homes. But hackers see them as entry points into peoples lives, giving them the opportunity to access data, eavesdrop on conversations or conduct other malicious actions without the owner being aware, said Oded Vanunu, Head of Products Vulnerabilities Research at Check Point. We conducted this research to highlight how securing these devices is critical to maintaining users privacy. Thankfully, Amazon responded quickly to our disclosure to close off these vulnerabilities on certain Amazon/Alexa subdomains. We hope manufacturers of similar devices will follow Amazons example and check their products for vulnerabilities that could compromise users privacy. Previously, we conducted research on Tiktok, WhatsApp and Fortnite. Alexa has concerned us for a while now, given its ubiquity and connection to IoT devices. Its these mega digital platforms that can hurt us the most. Therefore, their security levels are of crucial importance.

Amazon fixed this issue soon after it was reported.

For details of the vulnerabilities and a video showing how they could have been exploited, visit https://research.checkpoint.com

Follow Check Point Research via:Blog: https://research.checkpoint.com/Twitter: https://twitter.com/_cpresearch

About Check Point Research Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.

About Check Point Software Technologies Ltd.Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to governments and corporate enterprises globally. Check Points solutions protect customers from 5thgeneration cyber-attacks with an industry leading catch rate of malware, ransomware and advanced targeted threats. Check Point offers a multilevel security architecture, Infinity Total Protectionwith Gen V advanced threat prevention,this combined product architecture defends an enterprises cloud, network andmobile devices. Check Point provides the most comprehensive and intuitive one point of control security management system. Check Point protects over 100,000 organizations of all sizes.

MEDIA CONTACT: INVESTOR CONTACT:Ekram Ahmed Kip E. MeintzerCheck Point Software Technologies Check Point Software Technologiespress@checkpoint.com ir@us.checkpoint.com