12 ms·

Google Home (in)Security

310 points by hyperpape 8y ago

gitgud 8y ago
It worries me that Google - a Trillion dollar company - can make these security mistakes so easily exploitable. My faith in these smart IoT devices is completely diminished...
- black6 8y ago
  IoT -- where the S stands for Security!
michaelmior 8y ago
Of course this requires being authenticated to whatever network the Home device is connected to.
pkulak 8y ago
So what's the concern here; that when someone gets unfettered access to your local network they can reboot your Google Home? Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes.
- throwaway2048 8y ago
  Ah the old saw, just don't let the bad guys on your network, or execute code on your computer, or visit their websites, or be in contact with them in any way. This is _clearly_ the user's fault yes.
  - pkulak 8y ago
    The mere fact that more security is possible isn't a security vulnerability.
- jchw 8y ago
  I have occasionally had people in my complex accidentally print on my HP printer. It seems there's some wireless printing feature that is enabled by default and can be authenticated without needing physical access. The state of security for home networking devices could certainly be better. You forgot one though, they might also be able to delete your MongoDB collections :)
  - gerdesj 8y ago
    Point your browser at it and switch off the bits you do not need. Ideally, switch off the wifi altogether if you can use ethernet.
    - jchw 8y ago
      It is definitely not a WiFi printer. It is (was) connected to my machine via USB and it definitely didn't have my WiFi credentials. I would investigate further, but I've not had the printer plugged in for a while now.
      - Namidairo 8y ago
        They have a feature where it spins up it's own access point so that phones and the such can connect and print directly, so your wifi credentials wouldn't be required.
        jchw 8y ago
        Yeah, that's exactly what I'm guessing is happening. That said, I don't really know how to disable it. I may be a software engineer, but printers are another realm for me, a dark one with a weird Turing complete programming language at the core and numerous protocols ranging from moderately confusing to batshit insane to interface with these pieces of crap. OK, so printers aren't that mysterious. I can operate a CUPS server and whatnot. But I just can't muster enough concern to figure out how to access the network settings on my printer, and I'd be willing to wager I either need to boot into Windows, connect it to LAN, or both, to actually do this.
- bitwize 8y ago
  In 2002 or so I had a dream. I was touring the new, modern, internet-connected home. Decor could be changed with the touch of a button because most of the home's surfaces (walls, cupboard fronts, etc.) were OLED displays that could display any texture or color of the user's choosing. As I was touring this home of the future, there was a hack of the smarthome servers. And then it appeared--goatse. Goatse everywhere. On every wall, every cupboard front, every countertop, scaled to cover the entire surface, was goatse. It was horrible. So much for the home of the future. Now you know why I distrust smarthome technology.
  - Theodores 8y ago
    I have had a similar dream before, but with a couple of key differences: Given that most houses in most Western capital cities now cost millions and given that you can buy LCD panels for approximately the same price as bricks (for the same wall area) I do wonder why millionaires still stick with bricks. You could build a steel framed building and make all the walls, floors and ceilings from LCD panels saving yourself from having to have lights, pictures and regular TVs. With a few solar panels on the roof the electricity bill should be affordable too. My imagination for this extended to having live scenes from the seaside to have an immersive view of sunnier climes. Your imagination went to goatse though, maybe your fears and browsing habits informed your dreams differently to mine.
- gerdesj 8y ago
  My Redis and ES boxes have ufw on them and are on their own VLAN and need passwords etc. The Sonos are on another VLAN (SEWER - 802.1q tag 13) I don't have access to any RA music t home. I was traumatised enough by the eighties thank you 8)
- vvanders 8y ago
  In my mind it's a pretty gross violation of the principal of least privilege[1]. All it takes is one bad IoT device on your local LAN to exfiltrate/pivot over to the Hub. Some of the data that's dumped is things like "noise levels" which borders on sensitive PII information. Not to mention any vulnerabilities in these services that aren't understood yet. For all those reasons and more the IoT stuff on my local network goes into a VLAN that only gets to see the gateway and nothing else. No local UDP, TCP or the like, the Ubiquiti gear I picked up a while back makes it pretty trivial to setup. [1] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
  - adtac 8y ago
    This is all because of the current madness to have all devices connected each other. Completely connected "smart" things and network isolation/security: choose one.
    - superflyguy 8y ago
      If the devices I care about are secure (laptop, phone etc) then I shouldn't have to care about other devices, whether they're on my home network or not. I'm in no way a security/network export and I'm sure the people who came up with the current specs were smart people doing their best but it always seems a bit shit to me. I can send death packets to any device even if I'm not attached to the network and they're just honoured? Really? Was all this stuff created in a time when nobody actually considered bad people?
      - TeMPOraL 8y ago
        > Was all this stuff created in a time when nobody actually considered bad people? Yes. The Internet was designed in times where the primary worries were a) nuclear attacks causing major disruptions in the infrastructure, and b) pranksters. You can see that in the design of protocols, which assume all actors are participating in good faith. A lot of pieces of the Internet we still use were created for research community, where the default assumption was that everyone is acting benevolent (and if someone wasn't, they could be found and punished quickly through out-of-band means). I don't think anyone back then could ever imagine the amount of clueless, careless and evil people the commercialization of the Internet would bring to the network. Tangentially, this is also why we're stuck with programming in environments subpar compared to what we had in the 70s. The level of control people had over their OS and software also implied total lack of security.
- hyperpape 8y ago
  I actually get this perspective, as the endpoints listed here aren’t super sensitive (notifications do seem worth protecting). However, I’d still prefer to see security by default. With the current scenario, we have to track whether new, more sensitive features are introduced and whether or not they’ll introduce more security. As far as the local network, I think it can be assumed it’s insecure if you’re using any IoT devices. If not, then you might be able to trust it.
  - rdiddly 8y ago
    Sounded like the GP was making the case that it's a bigger deal, not a smaller one. Or at least I would find it so.
- vageli 8y ago
  Defense in depth is a thing. Relying on "perimeter" security is a surefire way to get owned. Your attack surface is much larger than your perimeter.
- bscphil 8y ago
  Speaking of rebooting vulnerabilities, I'm reminded of the CSRF vulnerability in the popular Motorola SB6141 modem. Not only can, say, a embedded resource in a forum reboot your modem, it can also request reprovisioning, which can take you offline for up to half an hour. It's been fixed, at least by my local TWC, but I wonder if all ISPs have rolled out the firmware update. https://www.securityforrealpeople.com/2016/04/arris-motorola-surfboard-modem.html https://www.securityforrealpeople.com/2016/04/arris-motorola...
  - lbeltrame 8y ago
    For the record, a popular ISP in my country designed its own router, which uses shell commands to compute the password hash, without even attempting to sanitize input[1]. If you have access to the login page (and until recently, it was also available via WAN) you could do all fancy tricks by putting the right commands in the password field, including bricking the equipment itself. [1] https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-shell-(SSH)#how-it-works https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-... People tried to contact the ISP and got no response back, of course.
    - pythonaut_16 8y ago
      Well of course not, all of the ISP's routers were already bricked.
- NamTaf 8y ago
  It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable security will have access to more privileged, sensitive information. The principle of least privilege, as a sibling pointed out, is important here because it sets the expectations of what a secure IoT device looks like. If we don't nip it in the bud now, this sort of lax security will become prolific even when more important information is at stake. Google should be leading the pack on 'the right way' to do security on IoT. They know better.
- minitech 8y ago
  > Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes. If they can do that (minus the piracy warnings) without further interaction/firewalls being turned off, that’s an indication of more problems, not an indication that whatever the article is about isn’t a problem. You act like people getting on an average home network is unthinkable, but it happens all the time with visitors, weak passwords, broken wireless protocols….
- amelius 8y ago
  You forgot: access your webcams, your photos and videos.
- solatic 8y ago
  I'm inclined to agree with you. Home security is not on the same level as enterprise security. What do people expect? That you're going to have IAM so that only you can reboot your router remotely and not your kids or your dinner guests? I mean, it's not like Google couldn't do it, it's just horrendously expensive for little benefit. And then we'll get people griping that Google forces you and your kids to all get Google accounts just to use your home network.
  - skywhopper 8y ago
    Security if these devices is very important. If even vendors like Google leave things this open, the risk is very real that these devices will be hacked and harnessed by criminals to make DDoS attacks, to use as proxies for criminal activity, to mine cryptocurrency using your electricity, to listen to and record activity in your home, to serve as jumping points to access your private data stored on open shared storage, or to steal your credentials to your bank. If we don’t push back against runaway lazy IoT security all of this will become commonplace very soon, and your lack of care about security in trivially pointless devices like Google Home will be horrendously expensive to you for very little benefit.
    - 908087 8y ago
      We're already well past the point of lazy IoT security becoming the norm.
- _pmf_ 8y ago
  > printing 1000 pages of porn from every printer No, because Windows domain group membership is required (your uninformed amateur setup might be different). > deleting all your Redis tables and Elastic Search indexes Don't you think that development tools that are used by (supposed) professionals have different requirements regarding out-of-the-box default behavior than a consumer product?
  - mavhc 8y ago
    You'd think so, but they're making the same mistake as well. Not building in authentication by default is crazy no matter where it is
- pdonis 8y ago
  This is not an argument for adding a Google Hub to the mix. It's an argument for not having devices on your network that will accept unauthenticated commands from any other device. Would you have your laptop or desktop computer on your home network allow unauthenticated telnet instead of SSH?
unsignedint 8y ago
Google Chromecast, and Home are actually pretty horrible when it comes to security. For example, if you lose internet connection, they will start broadcasting SSID. At this point, there's nothing in place to prevent someone launching Google Home app and hijack those devices. Even Chromecast and Hub displays codes, they are only to identify the device. Instead of the Google Home app asking you "what are the letters shown on your device?" it just tell you "Press OK if your device is showing ABCD" -- that's very dumb implementation. I don't know why they simply couldn't stand by to wait for the network connection to recover or require being present next to your device to press a reset button if their Network connection really needs to be updated -- or at least used simple authentication process to provision the device
- VikingCoder 8y ago
  You're hijacking them, but only if you get them on your own WiFi. And then they can't do anything to devices on my Wifi any more. They don't use my bandwidth, they can't control my devices, they're not connected to my account... So yes, you could make them play loud music, or make me miss my alarms. What other harm can you do? Genuine question.
  - unsignedint 8y ago
    > So yes, you could make them play loud music, or make me miss my alarms. Isn't that bad enough? I would be fairly pissed if someone do that. If someone hijack my device in the middle of night and start streaming loud music, I would be pretty pissed. Maybe not so much for alarms, though (As current design, if network goes out, alarm won't sound, so better to have backup anyways.) I'm mainly questioning Google's decision of why they designed the device to scream out loud "hey I'm here, and I can be hijacked!" while sporadic outage of the internet is not that uncommon in residential setting where it is mainly targeted for. And remember, those devices (especially Google Home) are capable, and often used to capture more than a directive of streaming media. Asking for your schedule, making a phone call, etc.
    - dragonwriter 8y ago
orcs 8y ago
Wish I was clever enough to figure this stuff out.
- voltagex_ 8y ago
  Start by running a packet capture on your home network - https://www.wireshark.org/ https://www.wireshark.org/
- SmellyGeekBoy 8y ago
  You'll never get there by wishing. It's not a difficult skillset to learn.
bradstewart 8y ago
This doesn't seem like a mistake, so much as a decision to assume the LAN is secure. It's a trade off that favors features over security. Which does seem rather "un-Googly" though... If it's unauthenticated, apps/devices/services can easily integrate with it. If it is authenticated, how? Pre-shared API key? How do you initially generate and distribute that API key? How do you access it? Now you need to encrypt that key when you use it. TLS? Great, now you need a TLS certificate that has to be trusted, updated, etc. All solvable problems for sure, but at the cost of complexity, ease of integration, etc.
- izacus 8y ago
  At the end of the day this is a cast device which will advertise it's presence to the whole network white active and allow anyone to send media to it (and mirror screen to Chromecasts, which have the same API exposed as the author says). Of course, the fact that you can't lock down Chromecast on a local network is a feature that could be very useful.
- harshreality 8y ago
  How is this difficult? "This is the first time you are using this phone to modify the settings of your google appliance. Please locate your google device, and press <some button>, or tap the microphone firmly, to confirm your intent to trust this phone."
  - throwawaymath 8y ago
    I would hate that.
  - bradstewart 8y ago
    It's not super difficult, particularly when the other end is a Google-provided app on a smartphone. It gets more complicated with things like Home Assistant[0] or other automation software. Amazon made the decision to force all Echo integrations to go through the internet. [0] https://www.home-assistant.io/ https://www.home-assistant.io/
  - ledriveby 8y ago
martimarkov 8y ago
I think only 2-3 endpoints should be protected. The others are there for information and they do provide some leakage but you already have most of that data anyway when you auth over the WiFi.
harshreality 8y ago
Why doesn't everything like that (affecting operation of the google appliance) require a preshared secret that's negotiated once per remote device via: - pressing a button or some other physical presence confirmation on the google device when a remote network device tries to gain credentials (Best!) - NFC (good because of range limitations, but annoying because of range limitations) - some kind of audio handshake (hackable from longer distances maybe extending beyond property boundaries, but so is bluetooth, and maybe with multiple mics a device could detect a higher-powered long-range hack attempt and filter it?) This might be the best option other than a physical button-press. If the confirmation signal is to hit the mic gently, can you even mimic that remotely through glass or a wall without doing something that would possibly deafen any bystanders? Seems a reasonable good compromise between ease of use and range limitation. - bluetooth, especially if power can be programmatically decreased to limit range to short-distance line-of-sight (obviously the normal bt range is a problem, but it's better than nothing) This is a solved problem, is it not? You only have to do that once, per remote device that needs to use the API. What's the problem with requiring a physical button press to trust a new device that's attempting to do something?
- mrep 8y ago
  All those would have limitations due to inter-vendor incompatibility. I think we need someone to develop a home IOT security standard protocol for how to handle this.
  - harshreality 8y ago
    The app is specifically aware of the IOT device's API in order to use it at all. Why wouldn't it be aware of the IOT device's method for presence + intention verification? I left out another option for adding additional authorizations (beyond the initial setup), which should work for "important" IOT devices, like google home or amazon echo, that are already associated with an account someone is using and monitoring: - Send a confirmation prompt to the primary Google/Amazon account holder: "Do the "do you authorize <device>/<app> to access the API on your Google/Amazon X device?" Standardization would be great, but implementing one or two more API calls to deal with first-use verification of a remote app doesn't seem like a big deal when the app is going to be doing lots of other stuff with that specific device's API.
amanzi 8y ago
If a bad actor get access to my LAN, rebooting my Google Home device is the least of my concerns. > "I am genuinely shocked by how poor the overall security of these devices are" If there's a remote access exploit in the wild, then I'm going to be worried.
- detaro 8y ago
  This looks like you could potentially hit from the browser with a DNS rebinding attack, just by visiting a website. (Although I'm not sure how far modern browsers defend against those by themselves)
  - hyperpape 8y ago
    I don’t think they do protect themselves https://twitter.com/bcrypt/status/955621661126008832 https://twitter.com/bcrypt/status/955621661126008832
  - rthille 8y ago
    OpenWRT's DNS server (dnsmasq) has DNS rebinding attack mitigations you can turn on. I'm not sure if they're on by default or not...
amanzi 8y ago
These commands don't work on my Google Home Mini device despite it having the same open ports as the one in the article. I get a `HTTP/1.1 403 Forbidden` response when trying to reboot it with this method.
- londons_explore 8y ago
  Patched already perhaps?
  - deckar01 8y ago
    I suspect these ports are only supposed to be open during the initial configuration phase. Maybe the author didn't actually finish setting up the device or maybe Google forgot to disable the configuration ports after setup.
jlward4th 8y ago
Hopefully it also has the CORS headers for cross-origin access. ;)
eugenekolo2 8y ago
~Doesn't seem to work on my Google Home Speaker (non-hub) as of 8:40PM EST. Tried the nmap restart payload. `nmap --open -p 8008 192.168.1.0/24 | awk '/is up/ {print up}; {gsub (/$|$/,""); up = $NF}' | xargs -I % curl -Lv -H Content-Type:application/json --data-raw '{"params":"now"}' http://%:8008/setup/reboot`~ http://%:8008/setup/reboot`~ Works after I changed to the right ip range.
- helper 8y ago
  I tried it today with my speaker and it worked.
  - eugenekolo2 8y ago
    Yeah, my bad, my networks not 192.168.1.x
kornish 8y ago
Evokes a great quote: "The S in IoT stands for 'security'."
millstone 8y ago
I'm in the "never permit these devil devices in my home" camp. A common rebuttal is "your phone is always listening, how is an Echo / Google Home / etc different?" Well this answers that question: security! If my phone could be remotely rebooted by someone on the same Wifi network, it would be considered an enormous vulnerability. But in this thread we see lots of apologetics: "Well, the LAN is assumed secure..." This reaffirms my decision. Offline-only, or no thanks!
- ehsankia 8y ago
  The Chromecast model is intentionally designed so that anyone on your local network can play anything they want on your Chromecast, including full blast volume porn. Considering that, how is being able to reboot your Chromecast any worse? The comparison to your phone doesn't hold. For one, your phone connects to all sorts of networks, whereas these devices are on local home network only. Second, Chromecasts are inherently shared and communal devices, whereas phones are personal.
jiveturkey 8y ago
would this pass muster under the new california iot security law? i think so, and the author should be ashamed.
Animats 8y ago
What does it take to show that this is totally unacceptable? An overlay for Google maps which shows who's not at home and has lots of valuable stuff, along with an app to disable the alarm?
- TeMPOraL 8y ago
  Did the Strava map debacle hurt the company? Doesn't look like it. So I doubt a similar map for Google would work either.
con023 8y ago
but where is the security issue? just reboot?
- df24g3t36 8y ago
  Availability is an important part of security, as much as Confidentiality and Integrity. Being able to reboot the device unauthenticated from the local network is a security issue, yes.
tempodox 8y ago
You might be interested in this keynote by James Mickens: https://www.youtube.com/watch?v=ajGX7odA87k https://www.youtube.com/watch?v=ajGX7odA87k titled “Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?”.
O2F2 8y ago
In my very personal opinion, anyone who willingly decorates their home with networked IoT devices, especially those talking to a external service, has already lost. With the increasing number of gizmos it's more or less inevitable that one of them (or rather all of them) ships with a gross, easy to exploit (an definitely wormable, because you know it'll be) oversight compromising your network because you're one of a million people getting owned by a bored skid. You want less timeboms in your home, not more. It's silly. Scale back, stop trying to mitigate around it and just don't buy this crap. You wouldn't keep a hand grenade with a toothpick for a safety pin on your desk because it'll be fine as long as everyone is really careful with it. But like I said, that's just the very angry voice in my head shouting into the void.
- shittyadmin 8y ago
  Isolation is key if you use any device like this. Separate VLAN for them means stuff like this won't even work and even if they get hacked, they'll have no special access into your network.
infact19 8y ago
I am 0 percent on board with home assistants and other IoT devices at this point. You either 1) buy an expensive surveillance device from a tech giant with an awful user privacy track record, giving them free access to your network and conversations (and even installing a spy camera in your home for some upcoming products, thanks but no thanks Facebook!), or 2) buy a shitty closed-source botnet-in-a-box that was either made by a home appliance company that has zero experience making secure software or from a startup that has zero experience in making either home appliances or secure software.
jarofgreen 8y ago
> I usually would have worked directly with Google to report these issues if they had not previously disclosed, but due to the sheer amount of prior work online and committed code in their own codebase, it is obvious they know. Can anyone explain this? Is he saying others have already reported this and Google don't care?

310 points by hyperpape 8y ago

It worries me that Google - a Trillion dollar company - can make these security mistakes so easily exploitable. My faith in these smart IoT devices is completely diminished...

black6 8y ago
IoT -- where the S stands for Security!

michaelmior 8y ago

Of course this requires being authenticated to whatever network the Home device is connected to.

pkulak 8y ago

So what's the concern here; that when someone gets unfettered access to your local network they can reboot your Google Home? Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes.

throwaway2048 8y ago
Ah the old saw, just don't let the bad guys on your network, or execute code on your computer, or visit their websites, or be in contact with them in any way. This is _clearly_ the user's fault yes.
- pkulak 8y ago
  The mere fact that more security is possible isn't a security vulnerability.
jchw 8y ago
I have occasionally had people in my complex accidentally print on my HP printer. It seems there's some wireless printing feature that is enabled by default and can be authenticated without needing physical access. The state of security for home networking devices could certainly be better. You forgot one though, they might also be able to delete your MongoDB collections :)
- gerdesj 8y ago
  Point your browser at it and switch off the bits you do not need. Ideally, switch off the wifi altogether if you can use ethernet.
  - jchw 8y ago
    It is definitely not a WiFi printer. It is (was) connected to my machine via USB and it definitely didn't have my WiFi credentials. I would investigate further, but I've not had the printer plugged in for a while now.
    - Namidairo 8y ago
      They have a feature where it spins up it's own access point so that phones and the such can connect and print directly, so your wifi credentials wouldn't be required.
      - jchw 8y ago
        Yeah, that's exactly what I'm guessing is happening. That said, I don't really know how to disable it. I may be a software engineer, but printers are another realm for me, a dark one with a weird Turing complete programming language at the core and numerous protocols ranging from moderately confusing to batshit insane to interface with these pieces of crap. OK, so printers aren't that mysterious. I can operate a CUPS server and whatnot. But I just can't muster enough concern to figure out how to access the network settings on my printer, and I'd be willing to wager I either need to boot into Windows, connect it to LAN, or both, to actually do this.
bitwize 8y ago
In 2002 or so I had a dream. I was touring the new, modern, internet-connected home. Decor could be changed with the touch of a button because most of the home's surfaces (walls, cupboard fronts, etc.) were OLED displays that could display any texture or color of the user's choosing. As I was touring this home of the future, there was a hack of the smarthome servers. And then it appeared--goatse. Goatse everywhere. On every wall, every cupboard front, every countertop, scaled to cover the entire surface, was goatse. It was horrible. So much for the home of the future. Now you know why I distrust smarthome technology.
- Theodores 8y ago
  I have had a similar dream before, but with a couple of key differences: Given that most houses in most Western capital cities now cost millions and given that you can buy LCD panels for approximately the same price as bricks (for the same wall area) I do wonder why millionaires still stick with bricks. You could build a steel framed building and make all the walls, floors and ceilings from LCD panels saving yourself from having to have lights, pictures and regular TVs. With a few solar panels on the roof the electricity bill should be affordable too. My imagination for this extended to having live scenes from the seaside to have an immersive view of sunnier climes. Your imagination went to goatse though, maybe your fears and browsing habits informed your dreams differently to mine.
gerdesj 8y ago
My Redis and ES boxes have ufw on them and are on their own VLAN and need passwords etc. The Sonos are on another VLAN (SEWER - 802.1q tag 13) I don't have access to any RA music t home. I was traumatised enough by the eighties thank you 8)
vvanders 8y ago
In my mind it's a pretty gross violation of the principal of least privilege[1]. All it takes is one bad IoT device on your local LAN to exfiltrate/pivot over to the Hub. Some of the data that's dumped is things like "noise levels" which borders on sensitive PII information. Not to mention any vulnerabilities in these services that aren't understood yet. For all those reasons and more the IoT stuff on my local network goes into a VLAN that only gets to see the gateway and nothing else. No local UDP, TCP or the like, the Ubiquiti gear I picked up a while back makes it pretty trivial to setup. [1] https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
- adtac 8y ago
  This is all because of the current madness to have all devices connected each other. Completely connected "smart" things and network isolation/security: choose one.
  - superflyguy 8y ago
    If the devices I care about are secure (laptop, phone etc) then I shouldn't have to care about other devices, whether they're on my home network or not. I'm in no way a security/network export and I'm sure the people who came up with the current specs were smart people doing their best but it always seems a bit shit to me. I can send death packets to any device even if I'm not attached to the network and they're just honoured? Really? Was all this stuff created in a time when nobody actually considered bad people?
    - TeMPOraL 8y ago
      > Was all this stuff created in a time when nobody actually considered bad people? Yes. The Internet was designed in times where the primary worries were a) nuclear attacks causing major disruptions in the infrastructure, and b) pranksters. You can see that in the design of protocols, which assume all actors are participating in good faith. A lot of pieces of the Internet we still use were created for research community, where the default assumption was that everyone is acting benevolent (and if someone wasn't, they could be found and punished quickly through out-of-band means). I don't think anyone back then could ever imagine the amount of clueless, careless and evil people the commercialization of the Internet would bring to the network. Tangentially, this is also why we're stuck with programming in environments subpar compared to what we had in the 70s. The level of control people had over their OS and software also implied total lack of security.
hyperpape 8y ago
I actually get this perspective, as the endpoints listed here aren’t super sensitive (notifications do seem worth protecting). However, I’d still prefer to see security by default. With the current scenario, we have to track whether new, more sensitive features are introduced and whether or not they’ll introduce more security. As far as the local network, I think it can be assumed it’s insecure if you’re using any IoT devices. If not, then you might be able to trust it.
- rdiddly 8y ago
  Sounded like the GP was making the case that it's a bigger deal, not a smaller one. Or at least I would find it so.
vageli 8y ago
Defense in depth is a thing. Relying on "perimeter" security is a surefire way to get owned. Your attack surface is much larger than your perimeter.
bscphil 8y ago
Speaking of rebooting vulnerabilities, I'm reminded of the CSRF vulnerability in the popular Motorola SB6141 modem. Not only can, say, a embedded resource in a forum reboot your modem, it can also request reprovisioning, which can take you offline for up to half an hour. It's been fixed, at least by my local TWC, but I wonder if all ISPs have rolled out the firmware update. https://www.securityforrealpeople.com/2016/04/arris-motorola-surfboard-modem.html https://www.securityforrealpeople.com/2016/04/arris-motorola...
- lbeltrame 8y ago
  For the record, a popular ISP in my country designed its own router, which uses shell commands to compute the password hash, without even attempting to sanitize input[1]. If you have access to the login page (and until recently, it was also available via WAN) you could do all fancy tricks by putting the right commands in the password field, including bricking the equipment itself. [1] https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-shell-(SSH)#how-it-works https://github.com/Nimayer/fastgate-toolkit/wiki/Get-a-root-... People tried to contact the ISP and got no response back, of course.
  - pythonaut_16 8y ago
    Well of course not, all of the ISP's routers were already bricked.
NamTaf 8y ago
It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable security will have access to more privileged, sensitive information. The principle of least privilege, as a sibling pointed out, is important here because it sets the expectations of what a secure IoT device looks like. If we don't nip it in the bud now, this sort of lax security will become prolific even when more important information is at stake. Google should be leading the pack on 'the right way' to do security on IoT. They know better.
minitech 8y ago
> Ya know what else they can do? Play Rick Astley on your Sonos speakers while printing 1000 pages of porn from every printer, casting Rick Astley music videos to every TV, getting Comcast to forward you piracy warnings and deleting all your Redis tables and Elastic Search indexes. If they can do that (minus the piracy warnings) without further interaction/firewalls being turned off, that’s an indication of more problems, not an indication that whatever the article is about isn’t a problem. You act like people getting on an average home network is unthinkable, but it happens all the time with visitors, weak passwords, broken wireless protocols….
amelius 8y ago
You forgot: access your webcams, your photos and videos.
solatic 8y ago
I'm inclined to agree with you. Home security is not on the same level as enterprise security. What do people expect? That you're going to have IAM so that only you can reboot your router remotely and not your kids or your dinner guests? I mean, it's not like Google couldn't do it, it's just horrendously expensive for little benefit. And then we'll get people griping that Google forces you and your kids to all get Google accounts just to use your home network.
- skywhopper 8y ago
  Security if these devices is very important. If even vendors like Google leave things this open, the risk is very real that these devices will be hacked and harnessed by criminals to make DDoS attacks, to use as proxies for criminal activity, to mine cryptocurrency using your electricity, to listen to and record activity in your home, to serve as jumping points to access your private data stored on open shared storage, or to steal your credentials to your bank. If we don’t push back against runaway lazy IoT security all of this will become commonplace very soon, and your lack of care about security in trivially pointless devices like Google Home will be horrendously expensive to you for very little benefit.
  - 908087 8y ago
    We're already well past the point of lazy IoT security becoming the norm.
_pmf_ 8y ago
> printing 1000 pages of porn from every printer No, because Windows domain group membership is required (your uninformed amateur setup might be different). > deleting all your Redis tables and Elastic Search indexes Don't you think that development tools that are used by (supposed) professionals have different requirements regarding out-of-the-box default behavior than a consumer product?
- mavhc 8y ago
  You'd think so, but they're making the same mistake as well. Not building in authentication by default is crazy no matter where it is
pdonis 8y ago
This is not an argument for adding a Google Hub to the mix. It's an argument for not having devices on your network that will accept unauthenticated commands from any other device. Would you have your laptop or desktop computer on your home network allow unauthenticated telnet instead of SSH?

unsignedint 8y ago

Google Chromecast, and Home are actually pretty horrible when it comes to security. For example, if you lose internet connection, they will start broadcasting SSID. At this point, there's nothing in place to prevent someone launching Google Home app and hijack those devices. Even Chromecast and Hub displays codes, they are only to identify the device. Instead of the Google Home app asking you "what are the letters shown on your device?" it just tell you "Press OK if your device is showing ABCD" -- that's very dumb implementation. I don't know why they simply couldn't stand by to wait for the network connection to recover or require being present next to your device to press a reset button if their Network connection really needs to be updated -- or at least used simple authentication process to provision the device

VikingCoder 8y ago
You're hijacking them, but only if you get them on your own WiFi. And then they can't do anything to devices on my Wifi any more. They don't use my bandwidth, they can't control my devices, they're not connected to my account... So yes, you could make them play loud music, or make me miss my alarms. What other harm can you do? Genuine question.
- unsignedint 8y ago
  > So yes, you could make them play loud music, or make me miss my alarms. Isn't that bad enough? I would be fairly pissed if someone do that. If someone hijack my device in the middle of night and start streaming loud music, I would be pretty pissed. Maybe not so much for alarms, though (As current design, if network goes out, alarm won't sound, so better to have backup anyways.) I'm mainly questioning Google's decision of why they designed the device to scream out loud "hey I'm here, and I can be hijacked!" while sporadic outage of the internet is not that uncommon in residential setting where it is mainly targeted for. And remember, those devices (especially Google Home) are capable, and often used to capture more than a directive of streaming media. Asking for your schedule, making a phone call, etc.
  - dragonwriter 8y ago

orcs 8y ago

Wish I was clever enough to figure this stuff out.

voltagex_ 8y ago
Start by running a packet capture on your home network - https://www.wireshark.org/ https://www.wireshark.org/
SmellyGeekBoy 8y ago
You'll never get there by wishing. It's not a difficult skillset to learn.

bradstewart 8y ago

This doesn't seem like a mistake, so much as a decision to assume the LAN is secure. It's a trade off that favors features over security. Which does seem rather "un-Googly" though... If it's unauthenticated, apps/devices/services can easily integrate with it. If it is authenticated, how? Pre-shared API key? How do you initially generate and distribute that API key? How do you access it? Now you need to encrypt that key when you use it. TLS? Great, now you need a TLS certificate that has to be trusted, updated, etc. All solvable problems for sure, but at the cost of complexity, ease of integration, etc.

izacus 8y ago
At the end of the day this is a cast device which will advertise it's presence to the whole network white active and allow anyone to send media to it (and mirror screen to Chromecasts, which have the same API exposed as the author says). Of course, the fact that you can't lock down Chromecast on a local network is a feature that could be very useful.
harshreality 8y ago
How is this difficult? "This is the first time you are using this phone to modify the settings of your google appliance. Please locate your google device, and press <some button>, or tap the microphone firmly, to confirm your intent to trust this phone."
- throwawaymath 8y ago
  I would hate that.
- bradstewart 8y ago
  It's not super difficult, particularly when the other end is a Google-provided app on a smartphone. It gets more complicated with things like Home Assistant[0] or other automation software. Amazon made the decision to force all Echo integrations to go through the internet. [0] https://www.home-assistant.io/ https://www.home-assistant.io/
- ledriveby 8y ago

martimarkov 8y ago

I think only 2-3 endpoints should be protected. The others are there for information and they do provide some leakage but you already have most of that data anyway when you auth over the WiFi.

harshreality 8y ago

Why doesn't everything like that (affecting operation of the google appliance) require a preshared secret that's negotiated once per remote device via: - pressing a button or some other physical presence confirmation on the google device when a remote network device tries to gain credentials (Best!) - NFC (good because of range limitations, but annoying because of range limitations) - some kind of audio handshake (hackable from longer distances maybe extending beyond property boundaries, but so is bluetooth, and maybe with multiple mics a device could detect a higher-powered long-range hack attempt and filter it?) This might be the best option other than a physical button-press. If the confirmation signal is to hit the mic gently, can you even mimic that remotely through glass or a wall without doing something that would possibly deafen any bystanders? Seems a reasonable good compromise between ease of use and range limitation. - bluetooth, especially if power can be programmatically decreased to limit range to short-distance line-of-sight (obviously the normal bt range is a problem, but it's better than nothing) This is a solved problem, is it not? You only have to do that once, per remote device that needs to use the API. What's the problem with requiring a physical button press to trust a new device that's attempting to do something?

mrep 8y ago
All those would have limitations due to inter-vendor incompatibility. I think we need someone to develop a home IOT security standard protocol for how to handle this.
- harshreality 8y ago
  The app is specifically aware of the IOT device's API in order to use it at all. Why wouldn't it be aware of the IOT device's method for presence + intention verification? I left out another option for adding additional authorizations (beyond the initial setup), which should work for "important" IOT devices, like google home or amazon echo, that are already associated with an account someone is using and monitoring: - Send a confirmation prompt to the primary Google/Amazon account holder: "Do the "do you authorize <device>/<app> to access the API on your Google/Amazon X device?" Standardization would be great, but implementing one or two more API calls to deal with first-use verification of a remote app doesn't seem like a big deal when the app is going to be doing lots of other stuff with that specific device's API.

amanzi 8y ago

If a bad actor get access to my LAN, rebooting my Google Home device is the least of my concerns. > "I am genuinely shocked by how poor the overall security of these devices are" If there's a remote access exploit in the wild, then I'm going to be worried.

detaro 8y ago
This looks like you could potentially hit from the browser with a DNS rebinding attack, just by visiting a website. (Although I'm not sure how far modern browsers defend against those by themselves)
- hyperpape 8y ago
  I don’t think they do protect themselves https://twitter.com/bcrypt/status/955621661126008832 https://twitter.com/bcrypt/status/955621661126008832
- rthille 8y ago
  OpenWRT's DNS server (dnsmasq) has DNS rebinding attack mitigations you can turn on. I'm not sure if they're on by default or not...

amanzi 8y ago

These commands don't work on my Google Home Mini device despite it having the same open ports as the one in the article. I get a `HTTP/1.1 403 Forbidden` response when trying to reboot it with this method.

londons_explore 8y ago
Patched already perhaps?
- deckar01 8y ago
  I suspect these ports are only supposed to be open during the initial configuration phase. Maybe the author didn't actually finish setting up the device or maybe Google forgot to disable the configuration ports after setup.

jlward4th 8y ago

Hopefully it also has the CORS headers for cross-origin access. ;)

eugenekolo2 8y ago

~Doesn't seem to work on my Google Home Speaker (non-hub) as of 8:40PM EST. Tried the nmap restart payload. `nmap --open -p 8008 192.168.1.0/24 | awk '/is up/ {print up}; {gsub (/$|$/,""); up = $NF}' | xargs -I % curl -Lv -H Content-Type:application/json --data-raw '{"params":"now"}' http://%:8008/setup/reboot`~ http://%:8008/setup/reboot`~ Works after I changed to the right ip range.

helper 8y ago
I tried it today with my speaker and it worked.
- eugenekolo2 8y ago
  Yeah, my bad, my networks not 192.168.1.x

kornish 8y ago

Evokes a great quote: "The S in IoT stands for 'security'."

millstone 8y ago

I'm in the "never permit these devil devices in my home" camp. A common rebuttal is "your phone is always listening, how is an Echo / Google Home / etc different?" Well this answers that question: security! If my phone could be remotely rebooted by someone on the same Wifi network, it would be considered an enormous vulnerability. But in this thread we see lots of apologetics: "Well, the LAN is assumed secure..." This reaffirms my decision. Offline-only, or no thanks!

ehsankia 8y ago
The Chromecast model is intentionally designed so that anyone on your local network can play anything they want on your Chromecast, including full blast volume porn. Considering that, how is being able to reboot your Chromecast any worse? The comparison to your phone doesn't hold. For one, your phone connects to all sorts of networks, whereas these devices are on local home network only. Second, Chromecasts are inherently shared and communal devices, whereas phones are personal.

jiveturkey 8y ago

would this pass muster under the new california iot security law? i think so, and the author should be ashamed.

Animats 8y ago

What does it take to show that this is totally unacceptable? An overlay for Google maps which shows who's not at home and has lots of valuable stuff, along with an app to disable the alarm?

TeMPOraL 8y ago
Did the Strava map debacle hurt the company? Doesn't look like it. So I doubt a similar map for Google would work either.

con023 8y ago

but where is the security issue? just reboot?

df24g3t36 8y ago
Availability is an important part of security, as much as Confidentiality and Integrity. Being able to reboot the device unauthenticated from the local network is a security issue, yes.

tempodox 8y ago

You might be interested in this keynote by James Mickens: https://www.youtube.com/watch?v=ajGX7odA87k https://www.youtube.com/watch?v=ajGX7odA87k titled “Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?”.

O2F2 8y ago

In my very personal opinion, anyone who willingly decorates their home with networked IoT devices, especially those talking to a external service, has already lost. With the increasing number of gizmos it's more or less inevitable that one of them (or rather all of them) ships with a gross, easy to exploit (an definitely wormable, because you know it'll be) oversight compromising your network because you're one of a million people getting owned by a bored skid. You want less timeboms in your home, not more. It's silly. Scale back, stop trying to mitigate around it and just don't buy this crap. You wouldn't keep a hand grenade with a toothpick for a safety pin on your desk because it'll be fine as long as everyone is really careful with it. But like I said, that's just the very angry voice in my head shouting into the void.

shittyadmin 8y ago
Isolation is key if you use any device like this. Separate VLAN for them means stuff like this won't even work and even if they get hacked, they'll have no special access into your network.

infact19 8y ago

I am 0 percent on board with home assistants and other IoT devices at this point. You either 1) buy an expensive surveillance device from a tech giant with an awful user privacy track record, giving them free access to your network and conversations (and even installing a spy camera in your home for some upcoming products, thanks but no thanks Facebook!), or 2) buy a shitty closed-source botnet-in-a-box that was either made by a home appliance company that has zero experience making secure software or from a startup that has zero experience in making either home appliances or secure software.

jarofgreen 8y ago

> I usually would have worked directly with Google to report these issues if they had not previously disclosed, but due to the sheer amount of prior work online and committed code in their own codebase, it is obvious they know. Can anyone explain this? Is he saying others have already reported this and Google don't care?