Precise Location Data Leak Found in Google Home and Chromecast Devices

Google Home and Chromecast GPS location leak [Fix Incoming]

The implication of this vulnerability doesn't limit to location data leak.

Google originally marked this issue as intended behavior when Young reached out in May, but the company has since changed its position.

"I've been consistently getting locations within about 10 meters of the device", Young told independent security blogger Brian Krebs, who got an exclusive first look at Young's findings.

Websites can usually obtain a general idea of the user's location through the IP address of the device accessing the website, but this method isn't extremely precise and the privacy of visitors is protected to some extent. "If you have a device and it allows you to do something without a password, it's very likely that an attacker can do the same using a malicious mobile app or via web pages with DNS binder rebinding, or via some other technique we haven't thought of yet". Craig Young, the researcher who discovered the flaw, says that "Although Google's app, which uses this functionality, implies that you must be logged into a Google account linked with the target device, there is, in fact, no authentication mechanism built into the protocol level". This makes it possible to extract the location data from the devices, Young wrote in a Monday blog post. "Commands to do things such as setting the device name and WiFi connections are sent directly to the device without any form of authentication". While many people are used to anonymous - and often unspecific - email scams, attackers could use precise location information to make them all-the-more convincing (and dangerous). “Threats to release compromising photos or expose some secret to friends and family could use this to lend credibility to the warnings and increase their odds of success, ” he said.

Young told PCMag the flaw is perfect for advertisers in search of someone's location.

Fallout 76's beta will launch first on Xbox One
The Fallout 76 site has been updated with a handy-dandy FAQ that provides a few nuggets of information about the forthcoming beta. Exact dates for the beta have not been announced, but Xbox One will get it first , followed by the PC and PS4.

From devices that order our groceries to smart toys that speak to our children, high-tech home gadgets are no longer the stuff of science fiction.

The test found that the Fredi Megapix home CCTV camera system operated over the internet using a default administrator account without a password, and Which? found thousands of similar cameras available for anyone to watch the live feed over the internet.

Google is expected to release a fix for the bug in mid-July.

'An attacker can be completely remote as long as they can get the victim to open a link while connected to the same Wi-Fi or wired network as a Google Chromecast or Home device, ' Young said. You also need to keep that link open for roughly a minute (the amount of time it takes to get a location), but that's not necessarily hard if there's enough content to distract the target.

'The attack content could be contained within malicious advertisements or even a tweet'.

Related:

  • NBA Mock Draft: Cleveland Cavaliers boost shaky backcourt

    NBA Mock Draft: Cleveland Cavaliers boost shaky backcourt

    But with last week's trade request, the NBA's annual offseason game of dominos is officially underway. For all the latest on James' free agency, follow our LeBron James 2018 free agency rumor tracker .
    Senate backs bill blocking deal with Chinese telecom firm

    Senate backs bill blocking deal with Chinese telecom firm

    Trump had said the deal to save ZTE was a precursor to upcoming trade negotiations with China, its largest trading partner. But the wrangling over the company produced a rare instance of Republicans allying with Democrats to defy Trump.
    Jay-Z Announced as PUMA's President of Basketball Operations

    Jay-Z Announced as PUMA's President of Basketball Operations

    Adding Jay-Z certainly brings an added air of legitimacy to the enterprise, in case adding two top prospects wasn't enough. The trio represents the first National Basketball Association endorsement deals for the brand in two decades.
  • Rupert Murdoch must increase Sky News budget to £100m

    Rupert Murdoch must increase Sky News budget to £100m

    Fox has agreed to sell the bulk of its assets, including its Sky stake, to Disney in a $52.4bn (£39bn) deal. Before Comcast made its offer, shareholders had been scheduled to vote to approve the pact with Disney .
    Yuya Osako snatches shock victory for Japan against 10-man Colombia

    Yuya Osako snatches shock victory for Japan against 10-man Colombia

    Tuesday's 2018 FIFA World Cup soccer games begin with a good Group H match between Colombia and Japan at 8 am EST / 5 am PST. Japan's experienced Yuto Nagatomo recently admitted their mindset would not change if Colombia lined up without Rodriguez.
    Tesla CEO Elon Musk emails staff alleging employee 'sabotage'

    Tesla CEO Elon Musk emails staff alleging employee 'sabotage'

    In fact, one employee is a saboteur and has been carrying out quite extensive sabotage in an attempt to damage the company. In another email sent on Monday (18 June), Musk warned of more possible sabotage in the form of a factory fire.
  • Thomas Markle reveals the warning he gave to Prince Harry

    Thomas Markle reveals the warning he gave to Prince Harry

    The boyfriend: "The first phone call was, "Daddy I have a new boyfriend", and I was like, "That's really nice". Meghan Markle's father was interviewed on British television for the first time since his daughter's wedding .
    Israel Targets Rights Groups by Outlawing Filming of Soldiers

    Israel Targets Rights Groups by Outlawing Filming of Soldiers

    Since major border protests broke out on March 30, more than 300 fires have been recorded, he added. The two sides have fought three wars since 2008 and observe a tense ceasefire.
    Emilia Clarke says goodbye to Game of Thrones

    Emilia Clarke says goodbye to Game of Thrones

    Her pairing with Jason Momoa's Khal Drogo is one of the OTPs (One True Pairing) in GoT fandoms. "Ever. Clarke's touching caption drew emotional responses from her TV co-stars, both past and present.
  • Trump adviser says 'nobody likes' family separation policy

    Trump adviser says 'nobody likes' family separation policy

    He agreed the family separations would serve as a deterrent to potential immigrants. "We are doing none of those things". The Obama administration also detained illegal immigrants at the border, but would detain parents and children together .
    Indonesian woman swallowed whole by python

    Indonesian woman swallowed whole by python

    The type of snake that killed Tiba was a reticulated python, which are widespread in Indonesia and other parts of Southeast Asia. The villagers cut open the 23ft-long creature and found Ms Tiba's body was intact after she had been swallowed head first.
    Higher levels of vitamin D may lower risk of developing breast cancer

    Higher levels of vitamin D may lower risk of developing breast cancer

    Vitamin D can be obtained in the diet, particularly from fortified foods, from supplements, and from sun exposure. Strong bone health, which is affected by vitamin D levels, was also associated with a 22 percent lower risk.

Comments

Latest news

Google Pixel 3 XL Leak Reveals Phone With Single Rear Camera Array
Of course, with a little reflection, there should be little to fear from Google sticking with a single sensor for the Pixel 3 XL . The logo has emerged in a collage of images showing the recent prototypes and components of the Pixel 2 and its larger sibling.

Senegal beat Poland for first African win at 2018 World Cup
With Colombia and Japan the other teams in Group H, it's shaping up to be one of the more balanced quartets in the competition. The FIFA World Cup 2018 Poland vs Senegal match will be broadcast live on Sony ESPN/HD, Sony TEN 2/HD and Sony TEN 3/HD.

Sweden bury World Cup opening jinx to beat South Korea
South Korean soccer supporters gather in front of the Seoul city hall in Seoul, South Korea to watch their team play in Russian Federation .

World's oldest Sumatran orangutan dies aged 62 in Perth Zoo
The world's oldest Sumatran Orangutan has been euthanised at a Perth Zoo, leaving behind a legacy of 54 descendants. The orange apes are solitary but social animals and tend to live in small groups until they reach adulthood.

Excessive gaming is now a mental health disorder
The WHO said that if gaming takes precedence over daily activities and life interests, then it can be classed as gaming disorder . For the first time, in this edition, the ICD has named and described "gaming disorder " in the section on addictive disorders.

Controversial Dunkin' Donuts sign causes social media uproar
He said the sign was old, but did admit to putting up a similar sign before. The franchise owner thought the sign was inappropriate and had it removed.

Greek govt survives no-confidence vote over Macedonia deal
The agreement still needs to be approved by Macedonia's parliament and pass a referendum. The outcome is far from certain because of opposition in both countries.

UK Official Shreds UN Human Rights Council Over Anti-Israel Bias
Haley has been the driving force behind the move, which would be unprecedented in the 12-year history of the council. During the first six years the United States was a member, resolutions critical of Israel dropped to one-fifth.

Father's Day Photo Shoot Celebrates Every Day Moments Between Dads & Kids
Flawless gift for Father's Day: His dream comes true, and his favorite son, Michael, becomes a senator and not a mob boss. I pray for his soul, I pray he guides us, I pray for all those who have lost their beloved fathers... miss you daddy.

Medicinal cannabis use to be reviewed by government
The use of cannabis for medicinal purposes is legal in many countries while others will not prosecute for personal use. However, the home secretary has warned a review would not pave the way for legalisation for recreational use.

Children Separated From Parents At Us Border Sob, Wail Desperately
He ties that racist language to his detention of thousands of children and family separation policy. Children traveling with the adults have been separated and placed in detention centers.

Zara Tindall Has Given Birth To Her Second Baby
Mia Tindall does not have a title either, so this little girl is unlikely to have one. The couple, who Wednesday in 2011, already have a four-year-old daughter, Mia.

England beat Aus to take 2-0 series lead
Maxwell topscored for Australia with 62 in Wednesday's first ODI against England which the visitors lost by three wickets. The most Australia have ever made batting second to win an ODI is 334 for eight against England at Sydney in 2011.

Meghan and Prince Harry likely to have children soon: Thomas Markle
Thomas Markle spoke to the hosts of " Good Morning Britain " about the royal wedding . George's Chapel and he can't think of a better replacement.

Rapper XXXTentacion In Critical Condition After Suspected Drive-By Shooting
XXXTentacion had been working on the finishing touches of his dream mansion just prior to his tragic death, it's emerged. He was taken to Broward Health North in Deerfield Beach , and the Broward County Sheriff confirmed he had died.

Other news