Hacker News Reader

Comment by unsignedint | Hacker News Reader

Google Chromecast, and Home are actually pretty horrible when it comes to security.

For example, if you lose internet connection, they will start broadcasting SSID. At this point, there's nothing in place to prevent someone launching Google Home app and hijack those devices.

Even Chromecast and Hub displays codes, they are only to identify the device. Instead of the Google Home app asking you "what are the letters shown on your device?" it just tell you "Press OK if your device is showing ABCD" -- that's very dumb implementation.

I don't know why they simply couldn't stand by to wait for the network connection to recover or require being present next to your device to press a reset button if their Network connection really needs to be updated -- or at least used simple authentication process to provision the device

View on HN

You're hijacking them, but only if you get them on your own WiFi. And then they can't do anything to devices on my Wifi any more. They don't use my bandwidth, they can't control my devices, they're not connected to my account...

So yes, you could make them play loud music, or make me miss my alarms.

What other harm can you do? Genuine question.

> So yes, you could make them play loud music, or make me miss my alarms.

Isn't that bad enough? I would be fairly pissed if someone do that. If someone hijack my device in the middle of night and start streaming loud music, I would be pretty pissed.

Maybe not so much for alarms, though (As current design, if network goes out, alarm won't sound, so better to have backup anyways.)

I'm mainly questioning Google's decision of why they designed the device to scream out loud "hey I'm here, and I can be hijacked!" while sporadic outage of the internet is not that uncommon in residential setting where it is mainly targeted for.

And remember, those devices (especially Google Home) are capable, and often used to capture more than a directive of streaming media. Asking for your schedule, making a phone call, etc.

> And remember, those devices (especially Google Home) are capable, and often used to capture more than a directive of streaming media. Asking for your schedule, making a phone call, etc.

But that's not super exploitable even with a hijack. You can know I asked for my schedule if you took control of my device, and feed me a fake one, but the work to make that useful rather than just a dead giveaway that something is wrong is non-trivial, and involves getting a bunch of personal info more worrying than the hack itself.

And you can know I tried to call a particular named contact, but again doing much with that is non-trivial.

Well, you can ask more specific questions, not just "what's my schedule" -- it is true but mileages may vary how much of information you can get out of hijacking. Since all the words followed by "Ok Google" will be captured and saved to attackers' Google account.

Regardless of impact this problem may exhibit, my point still stands that it shouldn't be hijackable, let alone at this ease.

If there’s ever a security exploit that can persist reboots .. that’s be a fun scenario.

> and hijack those devices.

And do what then? Serious question, I'm not a heavy user of Google Home/Chromecast, but my impression is that even if you hijack a device this way, the worst you can do is start streaming netflix or spotify, but with your own account to boot (not the account owner of the device you hijacked).

You can stream many types of content on a Chromecast (porn from a Chrome tab for instance, or your Android screen), and you don't need a Google account.

You've got to be on the network to execute this attack, which means you could already cast all the porn you wanted to the device anyway.

Turn on all your lights!

The hijack described takes them off the local network, but IIRC Home will only control devices on the same network, unless you—after you hijack it—you have access to connect it to some other service that controls the device, which requires already having the control you want to use the hijacked device for.

Nah, they've got cloud to to cloud integrations for stuff like LIFX bulbs, which only connect back to the LIFX cloud.

Right.

But the hijack proposed detaches the Home from the Google Account with which those integrations would be attached.

The attacker could expose his own lights to the victim, but not the other way around.

> And do what then?

For Assistant devices (Home, etc.) You can record (and get transcripts of) any requests made sent a Google Account you control, which can capture personal information.

For Cast targets, you can stream content to them (audio and possibly video, depending on the device.)

> the worst you can do is start streaming netflix or spotify

Netflix or Spotify is probably not the worst unwanted content you could stream into someone else's home unrequested.

I don't think Google Home can forget its configured network without either access to that network, or physical access.

If network connection is down for any reasons, or deauth packet is received, Google Home falls back to setup mode.[0]

In this mode, essentially Google Home becomes an access point without internet access and Google Home app can be used to configure new network.

[0]: https://9to5google.com/2014/07/21/chromecast-vulnerability-t...

I think you're confusing Chromecast and Google Home. The article you linked is about Chromecast. They don't behave the same way. If you lose access to the original network, a Google Home device needs a factory reset via a button.

That's not how it works, at least for ones I have. The moment they lose connection, it will start broadcasting SSID with device name with ".b" added. It will accept configuration from Google Home app. That behavior is common between a set of Chromecasts and Google Homes as far as I can see.

> For Cast targets, you can stream content to them (audio and possibly video, depending on the device.)

But if you're already on the wifi network, you can already stream content to them by design. Same with the apple tv and fire tv stick.

> But if you're already on the wifi network

The proposed attack is a way to take control of Home (and attach it to a new Google Account and network) when it loses wifi connection, it neither relies on nor provides the attacker access to the rightful owner's wifi network.

I discovered this a couple weeks ago and reported it to Google. Filed WONTFIX. A blog post is coming.

Forget hijacking. The issue is that it broadcasts the room name in beacon packets. Imagine things like Project Dragonfly Deployment Conference Room or <unique first name> Bedroom.

There are lots of reasons one doesn’t want these broadcast unencrypted into the street for wardrivers.

If you don't want to broadcast private data via the device name, simply don't put private data in the device name

"If you don't want your nudes to leak, simply don't take pictures of yourself naked."

"If you don't want people to read your email, just don't email anything you don't want printed in the newspaper."

Perhaps you don't understand the meaning of the word leak.

Also, it's not apparent it does it until it loses internet access. There is no warning or disclosure indication. It doesn't do it in normal operation; only when it loses internet connectivity, so there's nothing to indicate to even a savvy user that it will rat you out.

I of course went through and renamed my rooms to remove anything I don't want associated with my latitude/longitude for permanent record by wardrivers, but that's not the point.

The 4 digit authentication code prevents you from sending your WiFi password to an evil device.

Yeah, I'm not sure what flow lets you bypass that that GP is refering to. My impression was there aren't any, you always need to be able to see the screen to get the PIN code, and presumably there's rate limiting on trying codes.

I'm referring to that four letter code. Google Home app does not even request user to input that.

This screen only protect you from entering wi-fi details to third party that's potentially malicious.

However, since the implementation does not ask users to input that code into Google Home app, it won't protect someone other than you (as long as they are in wi-fi coverage of the device) to configure or hijack your device. (and Google Chrome/Home drops down to this "waiting for configuration" state every time internet connection becomes unavailable.)

Latter is the issue I have raised.

Ah, I misremembered I guess. I could have sworn I had to type it in to authenticate the chromecast device to my phone for initial bootstrapping.

Chromecast displays a pin on the display it's attached to and requires that pin to pair to a new account. I'm unsure what (if anything) Google home does (I remember "your home device played a sound", I don't remember if there was anything else.

FWIW, this "fixed" the security of both the Google Home and the Chromecast on the network I' connected to right now:

for i in {1..255}; do curl -Lv -H Content-Type:application/json --data-raw '{ "wpa_id": 0 }' http://192.168.1.$1:8008/setup/forget_wifi; done

Reply on news.ycombinator.com