Google Home and Chromecast GPS location leak [Fix Incoming]

Product Management Google Chromecast speaks about the Google Home Max speaker during a launch event in San Francisco California

Young also said the attack can be done completely remotely as long as the attacker can get the victim to open a malicious link while connected to the same network as the device. In many cases, IP geolocation offers only a general idea of where the IP address may be based geographically. Craig Young, the researcher who discovered the flaw, says that "Although Google's app, which uses this functionality, implies that you must be logged into a Google account linked with the target device, there is, in fact, no authentication mechanism built into the protocol level".

Mr Young found he could access router location data stored on a Home or Chromecast gadget via a computer connected to the same network. When exploited, that weakness can reveal your specific location accurate to within a few feet by Google's geolocation lookup services.

While attackers can more easily obtain location data through less complicated means such as your IP address, that information is not very precise.

"I've been consistently getting locations within about 10 meters of the device", Young told independent security blogger Brian Krebs, who got an exclusive first look at Young's findings.

Google is working on to release a patch for a bug that reveals user's location.

Ant McPartlin ex Lisa Armstrong 'SACKED' Anne-Marie Corbett
A source told the publication: "He's had a tough time of it, but Anne-Marie has put a smile back on his face again". Express.co.uk has contacted a representative for Ant McPartlin , Anne-Marie Corbett and Lisa Armstrong for comment.

Controversial sign at Dunkin' Donuts shop causes Twitter uproar
A local Baltimore Dunkin' Donuts promised their customers a free pastry and coffee if they snitch on employees speaking in a foreign language.

Microsoft takes a stand against ICE separating parents from children
A Microsoft spokesperson confirmed that an employee "briefly deleted the blog after seeing commentary in social media". Other tech companies have been criticized for their working relationships with the government.

Young created a video of the exploit in action, which has been successful in three environments and gleaned a precise street address on each occasion. When the researcher initially filed a bug report to Google describing the issue, the company dismissed the report, closing it with the message "Won't Fix [Intended Behavior]".

Why it matters: Practical applications stemming from the bug could include the possibility for more effective extortion or blackmail campaigns and highly targeted ads (for example, an advertiser could determine if a user is at work or home and serve different ads accordingly). "Threats to release compromising photos or expose some secret to friends and family could use this to lend credibility to the warnings and increase their odds of success". But when Krebs contacted Google about the location leak, the company reversed its decision to announce a software update would ship in mid-July 2018 to fix it. Of course Google knows where I am if I have a Chromecast or a Google Home device!

This allows the company to give you your location on its maps service, for instance, even when you are using a device with no Global Positioning System function, such as an old laptop.

The attack can be done remotely as long as the victim is connected to the same network as the device. "Although this does not by default prevent attacks from the IoT devices to the main network, it is likely that most naïve attacks would fail to even recognize that there is another network to attack". This method still needs just one internet connection - the routers keep the devices apart.

Related:

  • New Westworld Game Releases This Week

    New Westworld Game Releases This Week

    A Westworld mobile game will be coming on Thursday, June 21, putting the park's controls and legion of murderous robots at your fingertips.
    Sadio and Senegal see off Poland

    Sadio and Senegal see off Poland

    M'Baye Niang's strike secured victory on the hour, after a 37th-minute own goal handed Senegal the half-time lead. Poland and Senegal reasonably expect to advance out of Group H, making this first game monumentally important.
    Laurens lands French oaks glory

    Laurens lands French oaks glory

    But Laurens kept on gamely, and while five horses were separated by about one length at the finish, it was Laurens home by a neck. She has been strong late on in both her races this year.
  • Google Pixel 3 all but confirmed to keep single lens camera

    Google Pixel 3 all but confirmed to keep single lens camera

    Tech giant Google is said to be working on its next wave of flagship smartphones Google Pixel 3 and Google Pixel 3 XL . Google Pixel 2 XL for Rs 9,999 - what's the catch? But the latest leak hints that this expectation may not be met.
    Ajinkya Rahane on Standby as Rohit Sharma Gears Up for Yo-Yo Test

    Ajinkya Rahane on Standby as Rohit Sharma Gears Up for Yo-Yo Test

    Even Sanju Samson was dropped from India A's squad for the England A tour and was replaced by Ishan Kishan in the touring squad. Since a year ago , BCCI has made it mandatory for all the players to pass the test to get a place in the Indian team.
    Amazon Launches Alexa for Hospitality on Echo Smart Speakers, Marriot Signs Up

    Amazon Launches Alexa for Hospitality on Echo Smart Speakers, Marriot Signs Up

    Amazon already sells a version of Alexa for workplaces, and has struck deals to place Alexa in cars and refrigerators. The Wynn Resorts chain in Las Vegas installed the Amazon Echo in around 5,000 hotel suites in 2016.
  • Liverpool step up interest in Nick Pope

    Liverpool step up interest in Nick Pope

    Liverpool have stepped-up their interest in Nick Pope as Jurgen Klopp eyes a summer swoop for the £18m-rated Burnley goalkeeper, according to the Mirror .
    Caught on Camera: Ceiling Collapse Over Escalator In China

    Caught on Camera: Ceiling Collapse Over Escalator In China

    CCTV footage of the incident shows more than 10 people riding an escalator at a popular Chinese tourist spot in Huayin City. Emergency services rushed to the scene and a rescue operation was put into place to recover those buried under the debris.
    JUST IN! Chelsea strike terms with coach Antonio Conte

    JUST IN! Chelsea strike terms with coach Antonio Conte

    Zola remains a popular figure around Chelsea, whom he represented between 1996 and 2003 and scored 80 goals in 311 appearances. Sarri left Napoli last month by his move to Chelsea is imminent.
  • Square obtains NY State cryptocurrency license

    Square obtains NY State cryptocurrency license

    Square , founded by Twitter co-founder Jack Dorsey, has supported bitcoin trading in certain states since January. Its Cash app also facilitates mobile payments for businesses and friends.
    Evacuation at Winnipeg airport following 'possible security incident'

    Evacuation at Winnipeg airport following 'possible security incident'

    The evacuation was lifted at about 8:15 a.m., but several flights were delayed following the incident. It was the third evacuation at the airport in the past year.

    AMD trolls: will trade Core i7-8086K for Threadripper 1950X

    What exactly those steps are won't become clear until June 25, so watch that page on that date to find out what you need to do. Now, AMD is firing back at Intel's celebratory release with a giveaway of its own, but with an interesting twist.

Comments

Latest news

Draft Day trades to watch out for
If LeBron leaves this summer and then Leonard leaves next summer, the Cavs will nearly surely be one of the league's worst teams. So, if a deal for Walker or another player in the works for the No. 8 pick, we probably won't hear about it until draft night.

Guatemala ends search for people buried by volcano eruption
Volunteer firefighters continue to look for two missing colleagues in the Sacatepequez department. A 5.6 magnitude quake shook Guatemala on Sunday, according to the U.S.

Gunshot victim covered with sheet starts breathing again
Sinai Hospital by his girlfriend and is in stable condition, police said. "Paramedics put down that information", Santiago said. He said paramedics thought the teenager was dead, and covered him with a sheet before moving on to another shooting victim.

Fewer American Adults Are Smoking Than Ever Before
But just how safe are these trendy e-cigs? Fewer U.S. adults are smoking cigarettes, according to new government data . It was common almost everywhere - in office buildings, restaurants, airplanes and even hospitals.

Captain Kane gives England 2-1 win over Tunisia
Harry Kane sent England fans into a frenzy with his 91st-minute victor in England's World Cup opener against Tunisia . It couldn't start any better for an England player to get any press off his back by scoring a goal in the 11 minute.

We hear from Ashwin Willemse moments after SuperSport walkout report
According to Sport24 , Mallet and Botha have given testimony towards the probe but Willemse himself is yet to do so. The panel then agreed, off-air, that Willemse would be given the first opportunity to speak after the game.

England post new ODI record total
England , already 2-0 up in the series, smashed 79 runs off the first 10 overs as both openers cruised to individual fifties. Alex Hales made 147 off 92 balls and Jonny Bairstow 139 off 92.

Child scales 'un-climbable' pool ladder in video
Pools can be unsafe for young children and these parents want to spread the word about how you can never be too careful. The ladder was locked, covering the steps, but Cody was able to grab onto the slits in the door and pull himself up.

Meghan Markle's Dad Dishes on Conversation With Prince Harry About Trump
The boyfriend: "The first phone call was, "Daddy I have a new boyfriend", and I was like, "That's really nice". I realize it was a serious mistake, but it's hard to take it back.

What are your experiences of gaming addiction? Share your stories
Around the world, you're talking about roughly 2.5 billion people who are playing video games and digital and mobile games. Honestly, " gaming disorder " sounds like a phrase tossed around by irritated parents and significant others.

Dawid Malan dropped from England squad for Twenty20 series
England face Australia in a one-off T20 match on June 27 before hosting a three-match series against India starting on July 3. The pace bowler Mark Wood has been rested following his workload with the ball in the recent times.

Greece, Macedonia Sign Historic Deal To End Name Dispute
Across the border, Zaev has also met with opposition, with President Gjorge Ivanov saying he will not sign off on the agreement. VMRO-DPMNE leader Hristijan Mickoski urged Dimitrov to resign due to the "capitulation, which you think is a victory".

Stocks open sharply lower on trade tiff
US stock markets are opening sharply lower Tuesday as tensions over trade between the USA and China seem closer to a boil. The S&P index recorded two new 52-week highs and three new lows, while the Nasdaq recorded 28 new highs and 22 new lows.

Loughborough Junction: Fury as dead graffiti artists branded 'scum'
British Transport Police (BTP) described the death of the men, two aged 23 and one 19, as " unexplained ". It also emerged that the "tags" - graffiti nicknames - used by the artists are KBag, Trip and Lover.

United Kingdom will lose access to security databases after Brexit, says Barnier
Across Great Britain, 62% of respondents said Brexit negotiations were proceeding too slowly, with 30% blaming the delays on "politicians in Britain who want a soft Brexit or to stop Brexit altogether".

Other news