The conversations of Google Home users would have been spied on due to an error in the device

A researcher has discovered, with a ‘script’ developed by Python, an error in the speakers of Google Homewhich offered the possibility of installing a backdoor account to control these devices remotely and spy on user conversations.

SIGHT: Windows was reported to receive 5,000 times more malware than macOS in 2022

python is a programming language used in much of web applications, software development, data science, and ‘machine learning’. It is free to download and can be used on all systems.

A researcher named matt kunze has announced that it has recently received financial compensation from Google for one of its latest finds, focused on Google Home smart speakers.

LOOK: What jobs will be able to replace the AI ​​that ‘converse’ with us?

Specifically, Kunze has received US$ 107,500 for having discovered an error in these devices that allowed the installation of a backdoor account and that cybercriminals could have used to control them remotely and spy on user conversations.

The researcher, who used a Python ‘script’ to access the system of these devices, used a Google Home Mini for his experiment, although he has acknowledged that This type of attack offered the same results in other models of the brand.

SIGHT: Why is incognito mode not as safe as we think?

First, Kunze has insisted that at the beginning of his investigation he noticed how easy it was add new users to the device from the Google Home app”as well as link an account to the device, as can be read on his blog.

With this, he has exposed the different routes that cybercriminals can take to access the speakers developed by Google. First of all, mention the option to get the ‘firmware’ for the device by downloading it from the provider’s website. Next, performing a static analysis of the application that interacts with the device. In this case, Google Home.

LOOK: The cyber attack on Uber is among the 10 largest worldwide in 2022

can also be intercept communications between the application and the device or between these and the provider’s servers through an attack known as man-in-the-middle (MitM) attack.

The researcher used the Google Home application and realized that through it they could send commands remotely through the application programming interface (API) in the cloud. So, it used an Nmap scan to find the device’s local HTTP API port and configured a proxy to capture the encrypted HTTPS traffic.

Having obtained this data, he learned that the process of adding a new user to the target device required both the user’s name and the local API cloud ID and certificate. Specifically, to add a malicious user you implemented that connection in a python script, which reproduced the bind request.

LOOK: Apple would have decided: the iPhone 15 Ultra will not be manufactured exclusively at Foxconn

In this sense, Kunze describes the most likely attack scenario in the event that cybercriminals had taken advantage of said back door. First, it indicates that when attackers seek to spy on their victims within the proximity of Google Home, they gain access to their unique identifiers, or MACs.

Then, the attacker sends deauthorization packets to disconnect the device from the WiFi network and display Configuration mode. It then connects to this other configuration and requests the device information (name, certificate, and cloud ID).

After connecting to the internet and making use of the user’s data, it links their account to the victim’s device. From then on, you can spy on the victim without having to be near the device, but only through Google Home or the Internet.

LOOK: Do not accept all permissions when downloading an app! Some could put your device at risk

The researcher has published three proofs of concept (PoC) on GitHub for these actions, although he has stressed that these should not work on Google Home devices running the latest version of its ‘firmware’.

It should be mentioned that Kunze discovered this security flaw in January 2021 and informed the company of this issue in March 2021. Just a month later, in April, Google had already fixed this problem with a security patch.

However, as they advance in Bleeping Computer, Google Home was launched in 2016 and the programmed routines of its smart speakers only two years later, so Attackers could have exploited this vulnerability for years.

Source: Elcomercio

Callum

I have worked in the news industry for over 10 years. I have a vast amount of experience in writing and reporting. I have also worked as an author for a number of years, writing about technology and other topics.

I am a highly skilled and experienced journalist, with a keen eye for detail. I am also an excellent communicator, with superb writing skills. I am passionate about technology and its impact on our world. I am also very interested in current affairs and the latest news stories.

I am a hardworking and dedicated professional, who always strives to produce the best possible work. I am also a team player, who is always willing to help out others.