Google Home and similar

My family got a google home mini for christmas and are having me set it up. Am i correct to assume these are security nightmares? They seem like the worst thing you could willingly do? What is your opinion on them? What do you know about them?

A cell phone could always be listening. These things certainly always are, though.

There was a thing where TV commercials were using the phrases go activate the in home devices to go to websites, even though it is highly frowned upon, it is still very likely. Other problems include proprietary software, and the fact that it stores commands and voice data in the cloud (play that song I played Tuesday/reorder that thing I ordered last week) some of the newer ones even integrate with smart homes to work with smart lights and locks to my understanding if you configure it properly, imagine the possibilities...

I saw a an apple ad where they showed an iphone tied into a google home allowing you to control lights, blinds, tv, and climate. I have seen smarthome hacking in the past, but what is the feasibility of hacking a home device like with the alexa assistant or google home. has anybody tried scanning for smart devices on a large scale? this looks like it might be a good idea for a defcon presentation - perhaps "turning up the heat with smart home hacking" here is what i got from a conversation with the apple chat assistance >you control it using an app so smartphones are a vulnerability >your home network is tied to your phone >your device uses GPS check ins on your phone to determine if you are in the house or not so possibility for spoofing GPS locations in a smartphone to act like you want it to get toasty while you are at home >lists of authorized users allow multiple people to all adjust the temperature in the home if someone is able to give themselves access or somehow make the device think that you have one of the authorized devices, you can mess with the functions of everything temperature related in the house

fwiw these things are basically just thin client hardware for hitting api endpoints. if i remember correctly, it works like this: >"ok google..." >the thing starts recording >"...play the beatles" >voice recording is sent to google's natural language processing servers >nlp servers turn voice into text, and figure your "intent" >the server then figures out which "action" (basically the capabilities of a google home extension) would be best to fill your intend. >each action corresponds to an api node. google servers hit the proper spotify node and forward the response to the assistant. >the assistant then begins corresponding directly with either the third party server (typically running google code) or a different google server which is leased by a third party. >once it's established that you want the assistant to tell your phone to open spotify and play the beatles, it does so. the takeaway here is that everything hits google servers at least once, and most also hits third party servers as well (if you use any 3rd party app integration features). the only tasks that the assistant handles itself is pretty much dispatching commands to other connected devices and playing soykaf through it's speaker. i don't even thing the speech-to-text robot voice is rendered locally.

>>3569 to add on to this: i'm sure there are plenty of exploits. the whole system involves data bouncing around between god knows how many servers, each potentially owned by different companies, using apis that may or may not be secure, and there's an obvious place for an attacker to enter the ecosystem (i.e. set yourself up as a third party "action").

>>3570 the thing is, abusing ofne of these is as easiy as having a 5 year old sitting next to a computer just wasiting to take orders for candy. you obviously would never consider sitting a child next to a computer by himself, but this device accomplishes that same task with 1000% more efficiency. >embed mp3 in a webpage/advert that says "ok google" >device starts listening >have an mp3 that opens up a pre determined search result " zxcvbnmasd /im feeling lucky" type recording to minimize related searches to only your own site >once connection is made to URL, use any of a number of exploits to start loading viruses onto the entire network. alternatively, if there was a way to access these as the IoT, you could hypothetically DDoS by having the devices direct connection to a target over and over

Assume it's constantly recording and can be used as a pivot into your home network.

>>3573 that was the assumption in the court case where some police tried to get audio logs from amazon. http://www.cnn.com/2017/03/07/tech/amazon-echo-alexa-bentonville-arkansas-murder-case/index.html

We have computers gazillion times faster than *insert some old supercomputer mainframe name* in our pockets. Yet we still rely on remote servers to process our voice commands. Why is it so hard to make an autonomous system?

>>3580 >Yet we still rely on remote servers to process our voice commands. Why is it so hard to make an autonomous system? each system uses its own proprietary software to go about the process in a similar way, except that all of the companies wih services actually need your voice to suplement their databases. the voice samples that they gather get used to improve their own weak AI and help it create more natural speech bots and to gather context, ideally these companies would replace all human support with computers to reduce costs

>>3580 autonomous systems don't let companies datamine people

>>3580 >Yet we still rely on remote servers to process our voice commands >we talk for yourself

>>3580 >we can store a thousand times more information on a 5x5cm chip than we could in all the worlds paper libraries then why do i need to connect to a cloud to access my school books

>>3569 >"ok google..." >the thing starts recording Excuse my (potential) ignorance, but would this not require the device to always be listening anyway?

>>4136 It is because you haven't scraped them yet. When I wrote my scraper to dump an ebook I was required to get, I noticed that the location I was scraping it from did not check ownership of the book. This made it possible to dump books that I didn't "own." All the books are easily enumerable by just incrementing an id. >>4363 I have no clue on how it works, but yes it is always recording. It probably locally detects the trigger word before uploading what you are saying.

>>4367 >I have no clue on how it works, but yes it is always recording. It probably locally detects the trigger word before uploading what you are saying. Yes, this. I would be very surprised if these things were streaming absolutely everything in real time to Google/Amazon just to look for the trigger word.

>>4381 The device most likely only uploads voice clips once it has recognized the activation phrase, but I wouldn't be surprised at all if it also keeps an internal recording going whenever people are talking near it and if certain keywords turn up in that conversation it will be compressed and transmitted to a server for datamining

>>3524 Google Homes have a hidden API you can access unauthenticated https://rithvikvibhu.github.io/GHLocalApi/

>>6692 this is very cool. Thank you for bringing this to my attention.

>>3524 >google botnet You could try mycroft.

Absolutely botnet. Tell them they can switch their lights on/off from the magic light switch attached to the wall of (almost) every room.

>>4367 I saw a similar system that did the ownership check by running javascript code on the client, then redirecting the page.

My biggest issue with every IoT device is that they all have an internet connection, especially the ones that don't need one at all. I wish I could set it so they could connect all connect to a centralized server and then that would make all outside of network connections. Is that even possible?