Google to Fix Location Data Leak in Google Home, Chromecast

Google Chromecast Ultra 1

In Young's proof of concept, a user can be tricked to open a specially crafted URL containing the malicious JavaScript from a computer connected to a home network, which is also connected to a Google Home or Chromecast device. Attackers can exploit security weaknesses in Chromecasts and Google home speakers to get a list of nearby wireless networks.

According to Young, the bug allows a website to collect user's precise location data by exploiting a loophole in Google's systems to cross-check a list of nearby wireless networks with Google's precise geolocation look-up services.

Google said it plans to fix the security flaw, which leaks your location with an accuracy of up to a few feet, in an update next month. But this type of location information is often quite imprecise.

The implication of this vulnerability doesn't limit to location data leak.

Mice chew up cash worth Rs1.3 million inside ATM in India
In a weird incident, rodents tore to shreds notes worth Rs 12 lakh stored inside an SBI ATM in Assam's Tinsukia district . The ATM (DFBK - 000196116) belongs to the State Bank of India (SBI) and is located in Laipuli area of the district.

Brazil’s Neymar limps out of World Cup training session
World Cup Daily: Poland and Colombia fail to impress, while it just keeps getting better for hosts Russian Federation . Brazil face Costa Rica in St Petersburg 13:00 BST on Friday. "We said after the last game we need to improve".

Arsenal tie Granit Xhaka down to new long term contract
He joined the club from Borussia Mönchengladbach in the summer of 2016, winning the FA Cup in his first year with the Gunners. Arsenal will avoid the possibility of entering next season short-handed at the position.

Craig Young, the researcher who discovered the flaw, says that "Although Google's app, which uses this functionality, implies that you must be logged into a Google account linked with the target device, there is, in fact, no authentication mechanism built into the protocol level". You can see how quickly it can be achieved in the video below.

"Ive been consistently getting locations within about 10 meters of the device". In his own testing, Young said the data he pulled accurately pinpointed his house. This compares to a location two miles away when he tried to geolocate his IP address. "The Wi-Fi based geolocation works by triangulating a position based on signal strengths to Wi-Fi access points with known locations based on reporting from people's phones". For example, this sort of specific location data could easily be used in "blackmail or extortion campaigns", potentially making them more effective by giving more credibility to the threat. Young noted in his post that browser extensions and mobile apps are typically allowed to query location information without the user being notified about it. "Common scams like fake Federal Bureau of Investigation or IRS warnings or threats to release compromising photos or expose some secret to friends and family could use this to lend credibility to the warnings and increase their odds of success".

Young also recommended that all devices that run on the local network be configured as if they were exposed to the internet, especially if the data they transmit over the network is not authenticated.

"A much easier solution is to add another router on the network specifically for connected devices", Young wrote. The website does this by identifying the visitor's internet network and proceeds to scan for any connected Google devices. "Although this does not by default prevent attacks from the IoT devices to the main network, it is likely that most naïve attacks would fail to even recognize that there is another network to attack".

Related news:

Hot News

isis-killer-beheading-video-story-top ‘Money’ Is Why Sony Is Blocking Crossplay, Says Former SOE President
Jun 20, 2018 - 11:58
When Fortnite released on Switch last week, it reignited the discussion around Sony and its role in crossplay on consoles. Indeed, while this sort of pressure hasn't yet forced Sony into rectifying the situation, it has produced a response.

isis-killer-beheading-video-story-top Theresa May sets up new showdown, may reject Brexit proposal
Jun 20, 2018 - 11:48
He said on Tuesday: "But we can not accept the amendment on meaningful vote agreed in the Lords". The 119 majority was 28 more than the last time peers voted on the issue.

isis-killer-beheading-video-story-top Microsoft slammed for ICE contract, amid child separations
Jun 20, 2018 - 10:13
Customs and Border Protection on these immigration policies and is "not aware" of its software "being used for this goal ". We've reached out to Microsoft about the letter and will update this story when we hear back.

isis-killer-beheading-video-story-top Willemse’s TV walkoff review report due today
Jun 20, 2018 - 08:40
Khobane said that Mallett and Botha would return to on-air duty in the near future on a date to be confirmed. But Khobane conceded that Maleka said the report was poorer without Willemse's inputs.

isis-killer-beheading-video-story-top Trump assails Canadian tariffs, accuses people of smuggling United States goods home
Jun 20, 2018 - 08:31
They evade our export controls and they are coming with trillions of dollars to places like Silicon Valley to buy it", he said . The two sides have been involved in negotiations with China offering to buy $70 billion dollars in USA goods.

isis-killer-beheading-video-story-top Germany tells Trump to stop lying about their crime rate
Jun 20, 2018 - 08:08
One possible scenario: In Bavaria , Seehofer could order Germany's border police to close the global borders to refugees. It says around 30 percent of the applicants are from conflict-torn countries such as Syria, Afghanistan and Iraq.

isis-killer-beheading-video-story-top Egypt star's injury rued by Egypt's Cuper
Jun 20, 2018 - 07:52
But ahead of tonight's World Cup clash, Salah's profile has been dismissed as his opponents look to get in his head. I don't think majority expected, well certainly they didn't expect eight goals and two wins.

isis-killer-beheading-video-story-top Nabil Fekir could still join Liverpool
Jun 20, 2018 - 07:31
On Monday Fekir's agent Jean-Pierre Bernes suggested the deal isn't completely dead in the water just yet. We work a lot on it, we reinforce it.

isis-killer-beheading-video-story-top Sheriff: Deputy sexually assaulted child, threatened undocumented mom if she reported it
Jun 20, 2018 - 07:06
Salazar said that Nunez had family ties to the woman and her daughter, but that their relationship is unclear. Deputy Jose Nunez faces a minimum of 25 years in jail after allegedly assaulting a 4-year-old girl.

isis-killer-beheading-video-story-top Meghan Markle makes Ascot racing debut in royal procession
Jun 20, 2018 - 06:58
Though this will be their first visit to Ireland and husband and wife, it's not the first time they've ventured to the country. And when she met Harry and she spoke about how much she loves him, there's gotta be a child in the making soon.

isis-killer-beheading-video-story-top Portugal 'stronger than Morocco', says Andre Silva
Jun 20, 2018 - 06:55
This tournament is a chance for Suarez to play controversy-free soccer at this year's World Cup. The Morocco defender Nabil Dirar added: "Tomorrow will be a final for us, an important battle".

isis-killer-beheading-video-story-top Charles Barkley Gives the Worst 'Celebrity Family Feud' Answer
Jun 20, 2018 - 05:57
It's probably gonna be up there, though. "I told you yes, "person" sounds better", said Harvey. "Child? Baby? Damn, Chuck". Shaq and Chuck even made it to the "Fast Money" round and won $25,000 for Mustard Seed School.

isis-killer-beheading-video-story-top Canada legalises recreational cannabis use
Jun 20, 2018 - 05:46
So, he said, the dispute over home cultivation between the two houses of Parliament essentially comes down to "a single plant". Harder noted that the bill already allows provinces to limit home cultivation to just one plant, if they choose.

isis-killer-beheading-video-story-top Supreme Court Punts On Partisan Gerrymandering, Leaving Status Quo In Place
Jun 20, 2018 - 05:43
But not only did he refrain from writing separately, he also declined to join the concurring opinion put forward by the liberals. But as Kagan noted in her concurrence, that's not easy when one side has the power to entrench themselves in power for a decade.

isis-killer-beheading-video-story-top To prosecute migrants, 'you have to take the children away'
Jun 20, 2018 - 05:38
She said family separation is a "heartbreaking.issue that could be changed in a moment by the president of the United States". Earlier, the proceedings of migrant families were held in a civil court so that the families can be held together.