On June 8, Amazon, the Web giant with tentacles reaching into every nook and cranny of our lives, is going to stretch those tentacles out further by turning all its gadgets into little cell towers so they can help each other out with little slices of bandwidth. It’s created a new Wi-Fi protocol with no beta testing to get your gadgets to talk to one another: a recipe for potential security and privacy problems, some experts say.
The initiative is called Amazon Sidewalk. Amazon initially announced Sidewalk in September 2019, describing it as a “new, long-term effort to greatly extend the working range of low-bandwidth, low-power, smart lights, sensors, and other low-cost devices customers install at the edge of their home network.” While Sidewalk has been in the works for a few years, the news of the June 8 deadline for turning it on seems to have caught many by surprise: It gives consumers just a week to learn about the initiative and to opt out if they so choose.
As Amazon describes it, Sidewalk will do things like keep motion alerts from security cameras coming even when the Wi-Fi goes down; will stretch Wi-Fi out to smart lights at the edge of your driveway; and could act like Tile tags to help customers find pets and valuables. In fact, in May, Amazon announced that Tile is going to be joining Sidewalk, along with CareBand, maker of wearable technology for people living with dementia.
What Could Possibly Go Wrong?
A few things, it probably should surprise no-one that the impending mesh network turn-on date in seven days has triggered fear, uncertainty and doubt, for a few reasons. First, the initiative involves a brand-new, untested Wi-Fi protocol that’s going live without having been beta tested. Also, it’s being turned on by default, making it opt-out only.
Of course, customers will first have to know about the initiative before they can opt-out. Given that some security experts said that even they were taken by surprise over the weekend by the news of the June 8 go-live date, consumers who don’t work in the security industry will surely be even more oblivious. “They dropped this on us,” said Jon Callas, director of technology projects for the Electronic Frontier Foundation (EFF), in an interview. “They gave us seven days to opt out. I hadn’t even seen the privacy and security [white paper published by Amazon] before you sent it to me. They could have stage-managed this better.”
As well, customers will have to take it upon themselves to untangle their gadgets if they so choose, as opposed to knowingly opting in.
Second, security experts, while they do like what they see regarding security and privacy as detailed in the white paper, want to see more details. They anticipate problems, if simply because there are always flaws in new protocols.
Brand-New, Untested Protocol
Amazon is going to be running Sidewalk with its own, new Wi-Fi protocol, which uses the 900 MHz spectrum. The company projects that this will increase devices’ connection range by more than a half mile/one kilometer. If it all works out as planned, Amazon customers will be able to sprinkle Amazon gadgets around their properties like so many lawn ornaments, even in Wi-Fi and Bluetooth dead spots.
But the fact that this is a new, untested protocol is concerning. As pointed out by Ars Technica’s Dan Goodin, history is already littered with wireless technologies that have poor track records when it comes to encryption: First there was the easily cracked Wired Equivalent Privacy (WEP), then came Wi-Fi Protected Access (WPA): both of which were plagued with flaws that allowed easy decryption by eavesdroppers but which were nonetheless pervasive in older Wi-Fi networks. Those insecure Wi-Fi protocols make man-in-the-middle (MiTM) and malware-injection attacks all the more effective.
As Goodin put it, “If industry-standard wireless technologies have such a poor track record, why are we to believe a proprietary wireless scheme will have one that’s any better?”
No Stalking Mitigations
Finally, the white paper contains no details on mitigating stalking: an issue with devices such as Tile tags that can be slipped into purses or taped to the underside of cars in order to enable tracking.
“Stalking:That’s real, and a very bad thing,” Callas said. “If you think about it, if you have something like a Tile or [Apple AirTag] you can use to track anything with, to find out where you lost your keys, you can also drop one in somebody else’s handbag and track them. You can tape one to the bottom of a car. These can be used to stalk people.”
What Amazon Is Doing Right
As far as security and privacy go, Amazon’s white paper describes how Sidewalk will secure network packets with these three layers of encryption:
The Sidewalk Application Layer enables secure and private communication between the endpoint and the Application Server.
The Sidewalk Network Layer protects the endpoint’s Sidewalk packet over the air. Plain-text data in this layer is accessible only to the endpoint and the Sidewalk Network Server (SNS).
The Flex Layer, which is added by the Sidewalk Gateway (GW), provides the SNS with a trusted reference of message-received time and adds an additional layer of packet confidentiality. Plaintext data in this layer is accessible only to the GW and the SNS.
“This approach to encryption means that Amazon will not be able to interpret the contents of commands or messages sent through Sidewalk by third party services or endpoints (applications),” according to Amazon’s white paper.
Should We Worry?
Dmitry Kurbatov, CTO at Positive Technologies, said that problems are inevitable, but they aren’t serious enough to stop innovation. “Every time you introduce complexity or new function into the IoT ecosystem, this also creates the possibility for vulnerabilities, threats, exploitations and attacks,” he told Threatpost via email on Monday. “But it shouldn’t stop development. There are multiple ways to mitigate this additional risk, and I believe Amazon has implemented all the right steps. This is not the first usage of a mesh network, look at Apple AirTag – in principle, it uses the same approach and all is fine so far.”
He noted that once 5G is widely available across the US, there will be less need for a wireless mesh service like Sidewalk.
In the meantime, Sidewalk won’t be running with enough juice to cause much damage, Callas said. “80 kilobytes? That’s not enough to do much of anything. It’s not really an internet-sharing system,” he said. “It’s a device mesh communication system.”
How to Opt Out
Amazon has published this list of devices that will be pulled into Sidewalk on June 8: Ring Floodlight Cam (2019), Ring Spotlight Cam Wired (2019), Ring Spotlight Cam Mount (2019), Echo (third gen and newer), Echo Dot (third gen and newer), Echo Dot for Kids (third gen and newer), Echo Dot with Clock (third gen and newer), Echo Plus (all generations), Echo Show (all models and generations), Echo Spot, Echo Studio, Echo Input, and Echo Flex.
To opt out, owners of Echo and Ring devices can follow these steps on Alexa or Ring apps:
Alexa app: Open More > select Settings > Account Settings > Amazon Sidewalk, and toggle it on/off
Ring app: Tap “three-lined” menu > Control Center > Sidewalk, and tap the slider button
Make sure that opt-in out sticks: One reader said she opted out via the Alexa app. Then found that when the feature came to the Ring app, she’d been opted back in again. Whether you have both apps or even if you don’t, it’s a good idea to double-check to make sure your opt-out is truly registered.