This will return a json object containing the build version, device info, public key, and more. This can easily be done by sending a GET request to the /setup/eureka_info endpoint which is documented here( device-info API documentation). So first we must create some sort of fingerprint to identify chromecast devices that have this API endpoint exposed. I also found other documentation listed below.Īfter reading the documentation I had a much better idea of how the device worked and I pretty much knew how the hacker had pulled off the attack. I then came across the unofficial API documentation posted by someone else ( API documentation). Next I attempted to look for the API documentation but couldn’t what I wanted. So basically the vulnerability here is that any one who sends a post request to your chromecast device can make your TV play a youtube video.
Neat so I can send a POST request to :8008/apps/Youtube with a JSON body containing the data. After 5min of digging I discovered the following twitter post which pointed me in the right direction. Technical Details ReconĪccording to the internet the definition of chromecast is a streaming media adapter from Google that allows users to play online content such as videos and music on a digital television.Īt the time of writing this post this is a hot topic so I figured I could find some more details on social media sites(twitter). This peaked my interest so I set out discover how the hacker accomplished this. Its January 2nd, 2019 and like I always do I was checking my news feed and noticed an article about how some malicious hacker attacking chromecast which resulted in their TV being forced to render unwanted content ( News Article). NEW Hacking Group Slack Channel Introduction If you enjoy hacking and are looking for like minded people join below: I will be on everyday answer questions, doing CTFs, and talking about cool hacks. We welcome everyone from beginner to advanced to join. Before we get started I have started a new slack group dedicated to hacking.
0 kommentar(er)
