SoylentNews

fliptop [soylentnews.org] writes:

Experts uncover Google Home flaw that could have affected user privacy [techradar.com]:

Some Google Home smart speakers could have been hijacked to control the device remotely, and even listen in on people’s private [techradar.com] conversations, a security expert has claimed.

The bug was discovered by cybersecurity researcher Matt Kunze, who received $107,500 in bounty rewards for responsibly reporting it to Google.

[...] First, the attacker needs to be within wireless proximity of the device, and listen to MAC addresses with prefixes associated with Google.

After that, they can send deauth packets, to disconnect the device from the network and trigger the setup mode. In the setup mode, they request device info, and use that information to link their account to the device and - voila! - they can now spy on the device owners over the internet, and can move away from the WiFi.

Related: The Suspicion Becomes Real: Hackers Can Take Control of Alexa and Listen to You [soylentnews.org]

Original Submission