Alexa versus Alexa: Controlling Smart Speakers by Self-Issuing Voice Commands
The Alexa versus Alexa (AvA) attack exploits a vulnerability where an Amazon Echo device correctly interprets voice commands originating from audio files played by the device itself, known as a command self-issue vulnerability. This allows an attacker to remotely issue any permissible command, gaining prolonged control over the Echo and its connected smart devices without needing a physical speaker nearby. The research also introduced two related vulnerabilities: Full Volume and Break Tag Chain.