Thursday, December 7, 2023

Homehack Glitch : Hackers found a way to spy through LG SmartThinQ

Security Researchers have detected a flaw termed HomeHack in LG SmartThinQ mobile app that allows hackers to access all Electronic appliances present and get the live feed of the Surrounding through the integrated camera present in LG Hom-Bot robot vacuum cleaner.

The researchers discovered a glitch with the mobile app in the authentication process and the way in which it interacts with the LG infrastructure between apps and the devices.

This Basically consists of four steps:
1. Authentication request – verifies user credentials.
2. Signature request – creates a signature based on the username from authentication request.
3. Token request – use the signature response as a header and username as the parameter to get an access token for the user account.
4. Login request – sends the access token in order to log in to the application.

Also Read GoCrack – Password Cracking Tool for Security Professionals to test Password Effectiveness

These steps allowed hackers to detect that there is no dependency between the authentication request and the signature or token request, Which helped them to create a fake username which seems legit and get control over the devices.

“As more and smarter devices are being used in the home, hackers will shift their focus from targeting individual devices to hacking the apps that control networks of devices. This provides cybercriminals an opening to exploit software flaws, cause disruption in users’ homes and access their sensitive data,” said Oded Vanunu, head of products vulnerability research at Check Point.

Mitigations

After This LG Released a security patch for their LG SmartThinQ (V1.9.23) mobile app and suggested Users keep their application updated To be free from such vulnerability.

LG now plans to join forces With Check Point an Israel based multinational Company who detected this flaw to Secure their Devices.

LG’s SmartThinQ® range of smart appliances and safety solutions enable users to access and maintain their homes from a smartphone.

Sales of the Hom-Bot robotic vacuum cleaner alone exceeded 400,000 in the first half of 2016.  In 2016, 80 million smart home devices were shipped worldwide, a 64% increase from 2015.

Website

Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles