Started Off Local, Now We’re in the Cloud: Forensic Examination of the Amazon Echo Show 15 Smart Display (2024)

Contributions.

As we are not aware of any prior work on the Echo Show15,our main contributions are as follows:

Artifacts.

Our paper artifacts are open source and available atgithub.com/jcrasselt/amazon-echo-show-15,including curated overviews on both local and remote artifacts of the Echo Show15as well as scripts to ease data acquisition.

Outline.

Initially, we provide background information on the Echo Show15 and related work (Section2). Our examination results of the Echo Show15 are divided into three sections,namely hardware findings (Section3),file system findings (Section4),and companion app and cloud findings (Section5). Finally, we discuss our results (Section6),and conclude the paper (Section7).

2.1 Amazon Echo Show 15

The Echo Show15 is Amazon’s first wall- and stand-mountablesmart display and marketed for family organization andentertainment purposes, as well as for serving as a digital photo frameand smart home hub (Amazon, 2022). Since its release in 2021, the Echo Show15 has the largest screenamong all models and device generations within the Echo Show product family,as the other smart displays were primarily designed to be placed on a counter(e.g., Echo Show5, Echo Show8, or Echo Show10).

2.2 Related Work

Chung etal. (2017) proposed a general approach forexamining Alexa-powered smart devices forensicallyand suggested to organize the analysis based on thecomponents involved in the Alexa ecosystem, i.e.,Alexa-enabled devices,clients like companion apps or web browsers,the Alexa cloud,and the network communication within this ecosystem. Their analysis resulted in anunofficial Alexa \acsAPI description as well as CIFT,a proof-of-concept tool for cloud-based IoT forensics. Youn etal. (2021) performed a chip-off on an Echo Show (Gen. 2) deviceand extracted, inter alia, user credentials (i.e., Account ID, email address, and password)from the \acseMMC to access remote artifacts in the vendor cloud. Furthermore, they refined the unofficial \acAPI descriptionof Chung etal. (2017)by functionalities that are specific for smart displays.Krueger and McKeown (2020) investigated the Alexa \acAPI and thecloud artifacts of second- and third-generation Echo Dot devices,and found that certain information can be found in multipleplaces which facilitates the recognition of manipulation attempts.

Many previous work on Alexa forensicsfocused on detecting hardware debug interfacesfor obtaining file system access(Clinton etal., 2016; Hyde and Moran, 2017; Vasile etal., 2019; Vanderpot, 2017; Pawlaszczyk etal., 2019; ElFaramawi, 2020). Identifying such interfaces on \aclpPCB usually requires manual probingas available ports, pins, and \aclpTP are not necessarily annotatedand the board of each device has a different layout. In previous Echo models, different kinds of debug interfaces have been identifiedwhich led to file system access (e.g., JTAG, UART, eMMC, ISP). For more recent devices of Amazon’s Echo family, however, no debug interfaces werediscovered that allow reading the flash memory chip non-invasively,making a destructive chip-off procedure necessary.

The vendor’s cloud is of fundamental value for forensic investigations,as Echo devices store most of their user data remotely(Chung etal., 2017; Krueger and McKeown, 2020; Youn etal., 2021). Accessing this data, however, is not trivial, because nowadays credentials forthe Alexa \acAPI are only stored as encrypted tokens on the deviceand within companion apps (Hyde and Moran, 2017; Hutchinson etal., 2022). Although Olufohunsi and Agyekwena (2020) assumed that the encryption key is storedin the same database as the encrypted tokens, a decryption has not been reported yet,making investigators depend on either the cooperation of the user or Amazonduring data acquisition.

3.1 Micro-USB Port

When connecting the Echo Show 15 to a computer via its Micro-USB portand running lsusb,it is not recognized as a USB device. For Echo Dot smart speakers,a button combination has been identified in prior work(micaksica, 2017; Vanderpot, 2017)that boots the device into fastboot mode and makes itavailable as fastboot device. Fastboot is a protocol for communicating with the Android bootloader. For the Echo Show15, we found a similar button combination:Pressing the volume down and power/privacy button concurrently while powered off,the screen shows the Amazon logo on a black background after about four seconds. However, pressing both the volume up and down buttonand then the power/privacy button leads to a factory reset. Booted into fastboot mode, the Echo Show15 isrecognized by lsusb, and the toolfastbootcan read the bootloader variableswhich reveal that the bootloader is locked,the bootloader’s version (“01.01.220125.215459”),the device’s serial number (16 alphanumeric characters)and internal product name (“hoya”),and an incomplete partition table(boot, system, vendor, odm, data;cf. Table3 in Section4.3).

3.2 Printed Circuit Boards

For debugging and testing purposes, manufacturers often integrate\aclpTP (\acspTP) and portsfor serial communication into their \acpPCB. In earlier Echo models, such interfaces were availableand allowed to access a shell, to dump the firmware by reading the flashmemory, or to boot from an external SD card (Clinton etal., 2016). In later Echo models, however,those interfaces were either limitedor eliminated, whereby a chip-offremained the last option to access file system data(Pawlaszczyk etal., 2019; Youn etal., 2021).

3.2.1 UART Port

We compared the \acMLB of our Echo Show15 to internal photos of a pre-market versionsubmitted to the \acFCC (FCC, 2021)to identify missing components in the end productwhich may reveal debug ports. The front side of the pre-market\acMLB contained a 3-pin connector,while our board only had the contacts the connector was soldered to(cf. Figure3(a)). Considering the debug interfaces found in earlier Echo models,only \acsUART (\aclUART) uses three pins:Ground (GND), receive (RX), and transmit (TX).

Using a multimeter, the contact without \acTPwas identified as Ground, and both remaining contacts were measured around3.3V with a little fluctuation (TX) and constant 3.1V (RX), respectively. For establishing a serial connectionfrom the Echo Show15 to a computer via \acUART,we set an UART-to-USB adapter to 3.3Vand attached jump wires which weresoldered to the identified contacts on the \acMLB. We identified a baud rate of 921600 as fitting (8N1:8 data bits, no parity bit and 1 stop bit),while earlier Echo devices had baud rates of 115200 or 912000 (Vasile etal., 2019). Once the Echo Show15 was powered on,the command-line tool screen printed the boot logs,including the logs of the bootloader U-Boot(v2019.01, build ID “jenkins-fireos_main_pie-patch-build-193097”),which was already used as bootloader in previous Echo devices(Clinton etal., 2016; Vasile etal., 2019). The boot log was not followed by a login shell,as is sometimes the case for \acUART interfaces. In addition to the information that the firmware image is signedand the number of device starts (bootcount),the boot log indicated to “Hit Enter key to stop autoboot”,which led to a bootloader shell. Although available commands were revealed by tab completion,all of them were blocked.

3.2.3 eMMC Interface

During our search for further debug interfaces,we used a logic analyzer to check the signals of \acpTP on the \acMLB. Unlike the discovered asynchronous \acUART interface,other interfaces need a clock for synchronous communication(e.g., \acsJTAG, \acsISP, \acseMMC). Although we found a clock signal,we could not identify protocol-specific \acpTP systematically. Since we had not found a non-invasive way to read out the \aceMMC yet,we performed a chip-off. With the \aceMMC contacts being exposed after removing the chip,we were able to measure continuity between themand a group of \acpTP on the back of the \acMLB (cf. Figure3(b)),including the clock mentioned above. Figure4 shows thatall relevant \aceMMC channels (cf. Table1)can be accessed through undocumented \acpTP. For Ground, one of the grounded mounting holes can be used.

Channel	Description
CLK	Clock signal
CMD	Bidirectional command line
D0…D7	Bidirectional data lines
VCC	Input voltage for flash storage (3.3V)
VCCQ	Input voltage for controller (1.8V)
VSS(Q)	Ground

As our first Echo Show15 no longer had an \aceMMC chip,we continued our examination with the second device. To read its \aceMMC chip, needle probes were placed on all identified \acpTP(cf. Table1 and Figure4). Although the \aceMMC protocol can operate with 1, 4, or 8 data channels,we only used the D0-channel in 1-bit mode due to space limitations. The probes were connected to an EasyJTAG Plus box,a tool for reading various types of flash memory chipswhich is equipped with a 20-pin connector that is compatible witha variety of sockets and extension cards. We connected the probes directly to the 20-pin connector according to the pin assignment provided by the EasyJTAG Classic Suitesoftware (cf. Figure5). With the pinout mode “EasyJTAG2/E-Socket”,a clock rate of 1MHz,an IO voltage of 1.8V, and a bus width of 1bit,all partitions could be dumped. Based on partial partition information found in the fastboot variables(cf. Section3.1), however,we recognized the absence of the data partition. As the remaining unmapped space was about the same size as the missingpartition, we dumped the unmapped space as well. Eventually, the ext4 data partition could be extractedfrom the unmapped space with binwalk.

4.1 Test Data Generation

We installed the Echo Show 15 in a separate roomso that every stimulus to the camera and microphones could be documented. To correlate performed interactions and persisted artifacts,most interactions with the smart display were documented nearly to the second. The Echo Show15 was used between February and August 2023with Fire OS versions 7.5.0.1 (PS7501/4131) – 7.5.5.9 (PS7559/3534)as follows: Alexa was regularly asked for weather forecasts, news,and estimated travel times to work. Appointments have been created in the calendar,and a Google calendar was synchronized. The shopping and to-do lists were filled with itemsthat were occasionally ticked off. The built-in browser Silk was used to browse the Web via touchscreen,and to store credentials for certain websites. Movies were watched using Amazon’s Prime Videoas well as other services offered by Fire TV (e.g., YouTube). We created additional Alexa profiles and configured respective Voice IDs and Visual IDs. Since the Echo Show 15 responds to motion by waking up from a dimmed screen,we documented when a person was in the camera’s view and whether their face was visible to the camera. The camera was used to take pictures and videos,as well as for video calls via the Amazon Alexa companion app. Further, custom pictures were uploaded to the Echo Show15via the Amazon Photos companion app. Using the eponymous companion app,the capabilities of Alexa were extended by installing the Skill for Spotify. Finally, we linked a Wi-Fi smart camera to Alexavia the Skill “Yi Home Camera”for displaying the camera’s live image on the Echo Show15. A summary of artifacts generated by aforementioned activities is listed inTable2.

4.2 Partition Table of Fire OS

Using the non-invasive method described in Section3.2.3,a file system dump with the partitions in Table3was obtained from the Echo Show15. A partition table found in the log filecache:/recovery/last_kmsghelped to label the partitions. User-related data is stored on the data partition.

4.3 Known Artifacts from Previous Works

Local artifacts of forensic relevance have been identified in prior workfor several previous Echo products (cf. Section2.2). Youn etal. (2021) compiled a comprehensive list ofuser-related data on the Echo Show (Gen. 2)based on which we found, for example,Wi-Fi credentials, log files indicating voice interactions and camera usage,metadata of taken photos and videos, and browser data on the Echo Show15. Most of the remaining artifacts (cf. Table2),such as user-related data, voice commands, lists, calendars,device information, or photos and videos,however, are stored in the cloud andsynchronized with the companion apps or other connected Echo devices(Chung etal., 2017; Krueger and McKeown, 2020). An extensive and detailed overview of all our local and remote artifact findingsfor the Echo Show15, including a comparison with related work,is given in Table6. In the following subsections, we will therefore focuson device-specific artifacts discovered on the Echo Show 15.

4.4 Logs and Interaction Events

Fire OS uses Android’sDropBoxManager¹¹1developer.android.com/reference/android/os/DropBoxManager.htmlto write system logs on the data partition in/system/dropbox/ and /logd/ stored as ZIP archives named“Log.{category}@{unixtimestamp}.txt.zip” using the categoriescrash, events, kernel, main,metrics, system and vitals. Prior work showed that these logs allow to draw conclusions aboutuser interactions (Youn etal., 2021). Calling the wake word (i.e., voice command required to start interaction with Alexa)is logged in “Log.system.*” as WAKE_WORD event. Every button press is recorded as BUTTON_EVENT,and every touch on the screen as TOUCH_EVENT. On the Echo Show15, Alexa can be prevented from listening and watchingby pressing the power/privacy button,or by closing the camera slider(cf. Figure1(b)),resulting inPRIVACY_MODE_{ON,OFF} andCAMERA_{EN,DIS}ABLED eventsbeing logged in “Log.system.*”, respectively.

4.5 Visual ID Artifacts

Due to its face recognition feature,the Echo Show15 constantly observes the room via its camera,even when users are not actively interacting with the device. Interestingly, Visual ID does not identify userswhen the device was started without Internet connectionand stays offline. However, if the device is started while connectedto the Internet and then taken offline,Visual ID works. When the camera observes any movement,a MOTION event is loggedin “Log.main.*”,indicating whether the motion originatedfrom a person and whether that person is enrolled in Visual ID,as well as the reliability of the detectionvia a face quality score and the personId of the recognized face,which is also reported to the Alexa cloud. The database “/data/com.amazon.alexa.identity/databases/recognition”stores the personId of users enrolled in Visual ID in the tableFaceEnrolledProfilesRecognition. Note that values in the column lastRecognizedTimeMillisdo not indicate the last time a user was recognized,but—in our case—more likely the last time the device was started. The main user, whose Amazon account is loggedin, can be identified by searching for their personId in theaccount_data_key columnof the table account_data in the databasedata:“/data/com.amazon.imp/databases/map_data_storage_v2.db”to link it to their directedId from columnaccount_data_directed_id. The corresponding username of the directedIdcan be obtained via theAlexa \acAPI (cf. Section5.2.2).

4.6 Token Database

While Youn etal. (2021) couldretrieve user credentials from the Silk browser,this was no longer possible for the Echo Show15. Although the user is automatically logged in into the Amazon website,an explicit login was required to accesscloud \acpAPI (cf. Section5.2)and the Alexa webpage alexa.amazon.com;the latter allowed to view data stored in the cloud,but was taken offline during our tests. In earlier Echo models, the database “map_data_storage.db”contained access tokens for communicating with the Alexa \acAPI(Chung etal., 2017). Eventually, it was succeeded by “map_data_storage_v2.db”in data:“/data/com.amazon.imp/databases/”, whichstores all tokens in encrypted form andis also present in the Alexa app (cf. Section5.1.1). Olufohunsi and Agyekwena (2020)assumed that the Base64-encoded value forkey_encryption_secret in the tableencryption_data could be the encryption key,but did not determine the type of encryption in use. To identify the most likely encryption scheme,we searched for open-source projects from Amazonand found²²2github.com/aws/amazon-s3-encryption-client-javathat the values in “map_data_storage_v2.db” wereencrypted using AES with \acfCBC, PKCS#5 padding,and an initialization vector length of 16. Based on this information and the unprotected encryption key,the “refresh token” for the Alexa \acAPI could be decrypted,resulting in unrestricted access to cloud artifacts(cf. Section5.2, Table6).

5.1 Storage of Companion Apps on Smartphone

We set up a rooted \acAVD (9.0) to access the local datastored by the two companion apps for the Echo Show15in the storage of an emulated smartphone via adb.

5.2 Amazon and Alexa Cloud

Using an emulated smartphone (cf. Section5.1),the network traffic of the companion apps has been interceptedby installing a custom root certificate in Android. The remote artifacts identified for the Echo Show15,which are accessible through vendor \acpAPI,are summarized in Table6,including a scope-wise comparison with related workfor the individual local and remote artifacts.Below, we first focus on the insights that we gathered aboutthe different authorization methods (Section5.2.1)and kinds of user IDs (Section5.2.2)which are relevant for user identification when obtaining cloud artifacts. Afterward, we report on multimedia artifacts wrt.voice requests (Section5.2.3)as well as photos and videos (Section5.2.4),before we address a GraphQL \acAPI (Section5.2.5)that was not mentioned in the literature yet.

6.1 Practical Relevance of Findings

Since data acquisition has become increasingly challengingfor even well-known devices like smartphones due to encryption,if not impossible without users’ cooperation,acquiring data from unconventional devices during real-world investigationsis unsurprisingly non-trivial.In many cases, as outlined methodically by Stachak etal. (2024),“manual acquisition” approaches via the user interfacenot only provide rather limited access to relevant artifacts, if any,but also jeopardize forensic soundness. While file system access via “OS-based” interfacesis often restricted or not available at all,“hardware-based” acquisition techniques, if applicable,require specific knowledge and experience;in the case of chip-off, as a last resort, a certain willingness to take risksis required due to the possibility of complete data loss.

All aforementioned obstacles to examining unconventional devicesin both single- and multi-source analysis contextsapply to the Echo Show15 and its extended ecosystem consisting of companion apps and vendor cloud. Combining our individual findings, however, results in a comprehensivedata acquisition strategy for Echo Show15 devices, covering both local and remote artifacts(cf. Figure6):

Based on the undocumented pinout for the eMMC interfacethat we identified (cf. Section3.2.3),forensic investigators are now able to dump the file system non-invasively( , ). Knowing how to decrypt the refresh_token ( ; cf. Section4.6),which seems to be indefinitely valid and is storedin the credential database “map_data_storage_v2.db”on the device together with the corresponding encryption key,forensic investigators can now request a temporary access token or session cookie ( )to authenticate themselves against the vendor \acAPI,resulting in unrestricted access to user- and device-related remote artifactsstored in the vendor’s cloud ( ).

6.2 Artifacts in Light of Related Work

A detailed overview of all localand remote artifacts (cf. Section4, Section5)which we identified for the Echo Show15are summarized in Table6,including a comparison with related workregarding the coverage of individual artifacts.Additionally, we indicate which user IDs (cf. Table5)are obtainable from certain artifacts,as these IDs are relevant for querying certain \acpAPIand attributing found artifacts to user accounts.Except for two seemingly deprecated APIs for obtainingWi-Fi credentials and user interactions with Alexa,as well as the RKStorage1 artifact,we could either confirm the existence of known artifactsfrom previous work and earlier Echo devices(Chung etal., 2017; Hyde and Moran, 2017; Krueger and McKeown, 2020; Olufohunsi and Agyekwena, 2020; Youn etal., 2021),or report on yet unaddressed artifacts across the multi-source environment of our examinationconsisting of the Echo Show15, the two companion apps,and the Amazon cloud.

6.3 Limitations and Future Work

After our test data generation, we discovered that local logs on the Echo Show15are deleted after about three days, which resulted in certain performed actionsnot being detectable in log files. To strive for a more systematic mapping of performed actionsduring test data generation (cf. Section4.1)and corresponding persisted artifacts on the file system of the Echo Show15,differential forensic analysis (Garfinkel etal., 2012)could be performed based on more frequent and atomic file system images, as, for example,done by Eichhorn etal. (2024). Additional usage scenarios could be considered during test data generationto take further user interactions and behaviors into account.

The failed cross-site request forgery checkthat occurred while testing the GraphQL \acAPI(cf. Section5.2.5)could be solved by analyzing the codeof “com.amazon.alexa.identity.apk” found on the Echo Show15,albeit the legal situation for researchers in this regard may vary by country.

We identified unused pins for a Micro-HDMI port(cf. Section3.2.2)which we soldered to an HDMI breakout boardto test the Echo Show15 as both input and output device. Although all soldered connections were checked for continuity,our attempts failed, leaving it for future work to figure outwhat the purpose of the Micro-HDMI port is,whether it needs to be activated in Fire OS,or what we have missed.

The database “map_data_storage_v2.db” (cf. Section4.6),was also used by a dedicated app for the fitness tracker Amazon Halo(Hutchinson etal., 2022), which raises the questionwhether other smart devices by Amazon use the database as well,and whether the refresh tokens have the same scope of permission on all devices. Additionally, our database contained another token (adptoken)which is likely for the \acAPI of Audible, Amazon’s audiobook and podcast service,as well as further tokens with sensitive nameswhose particular purposes and contexts of use, however,have not been investigated yet(e.g., privatekey, encrypt.key).

At the time of writing, it became public that Amazon willdiscontinue to build their \aclOS upon Android(Roettgers, 2023; Welch, 2023).While it is yet unknownwhich devices will run the new \acsOS with the internal name Vega,the unveiled pinout for the eMMC interfaceon the Echo Show 15 (cf. Section3.2.3)could potentially become handy if Vega is rolled out on older devicesand its file system remains unencrypted. Moreover, as the pinout for the \aceMMC interfacecan be used for write access, it remains to be seen whethermanipulations of the firmware become feasible,despite it being signed (cf. Section3.2.1).