‘No evidence user information at risk’ says Google regarding Home Hub security

Google Home Hub showing feature menu

  • A popular hacker published a blog entry describing multiple security vulnerabilities regarding the Google Home Hub.
  • According to the hacker, the Google Home Hub “allows near full remote unauthenticated control by an (undocumented) API.”
  • Google, however, refutes the claims as inaccurate and says “there is no evidence that user information is at risk.”

Yesterday, Jerry Gamblin published an article on his personal blog detailing several security vulnerabilities he found in his new Google Home Hub. Although the article is incredibly technical with hundreds of lines of code, even a layman can tell Gamblin thinks the Google Home Hub is very insecure.

Gamblin sent out a tweet to his 11,000 followers to promote the article. In the tweet, he says “the security of the new Google Home Hub … is beyond dismal,” and “allows near full remote unauthenticated control by an (undocumented) API.”

You can see the tweet below:

According to Gamblin, it is not difficult to hack into a Google Home Hub to run several commands which could be labeled a security risk. For example, one can restart the entire Home Hub, delete the currently-configured wireless network, or disable all notifications.

Editor's Pick

Google Home Hub: Google’s in-house smart display announced

After months of rumors and more than one leak, the Google Home Hub is now official. The smart display market is still in its infancy, but perhaps the Google Home Hub is the push it …

Gamblin concludes, “I am genuinely shocked by how poor the overall security of these devices are, even more so when you see that these endpoints have been known for years and relatively well documented.”

However, Android Authority reached out to Google directly for a comment on the allegations Mr. Gamblin makes. This is the response we received from a Google spokesperson, reprinted in full:

“All Google Home devices are designed with user security and privacy top of mind and use a hardware-protected boot mechanism to ensure that only Google-authenticated code is used on the device. In addition, any communication carrying user information is authenticated and encrypted. A recent claim about security on Google Home Hub is inaccurate. The APIs mentioned in this claim are used by mobile apps to configure the device and are only accessible when those apps and the Google Home device are on the same Wi-Fi network. Despite what’s been claimed, there is no evidence that user information is at risk.”

It seems Google is saying that although Gamblin’s security code snippets are legitimate, he’s neglecting to point out that only devices connected to the same network as the Google Home Hub — i.e., your home network — could cause these things to happen. If a rogue hacker were to somehow gain access to your home network, your Home Hub could be compromised, but that would be true of pretty much anything connected to your home network, not just your Hub.

This is a nice reminder to make sure your home network is as secure as possible.

NEXT: Google Home Hub review: A home with a view



from Android Authority https://ift.tt/2ESlpZR
via IFTTT

Comments

Post a Comment

Popular posts from this blog

Removable batteries discussion

I have always preferred phones with removable batteries so far, thinking that it will most certainly be the first component in a device to fail. I have even advised people in my circles to do so, until a recent event. A family member of mine still uses a HTC DesireX. Recently, he wanted to replace his battery because of swelling. He bought two matching batteries from different sellers. The problem is, even though they were unopened/sealed packages of original batteries, they were not holding much charge. (I suppose they waited on a shelf for some time.) This made me question myself. In the past, I have used nokia smartphones, and they were easy to replace with fresh batteries, since almost all nokias used the same battery type. Now with android, its all over the place. Is it even worth it to go for a removable battery device when you cant find a replacement a couple of years after you purchase it? What do you think/prefer? PS. I realize this is not exactly fault of android OS, but ...
Read more