The VOCODES Kill Chain for Voice Controllable Devices

In this paper, we introduce a formalisation of attacks on Voice Controllable Devices (VCDs), focusing specifically on attacks leveraging the voice command self-issue. The presentation starts from the seminal Lockheed Martin kill chain, which is used to derive a tailored kill chain with the necessary steps to perform self-activation attacks. Our new kill chain, termed the VOice COntrollable DEvice Self-issue (VOCODES) kill chain, is relevant to assess both ongoing and past attacks, enhancing analysis activities of both ethical adversaries and of defenders. To demonstrate VOCODES in practice, we use it to analyse a popular self-issue attack against Amazon Echo devices, that is, the AvA attack. We show that the VOCODES kill chain succeeds in the full description of the attack and all its nuances. Moreover, it is effective to quickly map out the attacker’s malicious activities over specific attack steps, thereby favouring their interpretation. Finally, we show that, even if VOCODES is derived from the Lockheed Martin kill chain, VOCODES addresses some of the drawbacks of the seminal kill chain which have been pointed out over the years.