Homehack Glitch : Hackers found a way to spy through LG SmartThinQ

Security Researchers have detected a flaw termed HomeHack in LG SmartThinQ mobile app that allows hackers to access all Electronic appliances present and get the live feed of the Surrounding through the integrated camera present in LG Hom-Bot robot vacuum cleaner.

The researchers discovered a glitch with the mobile app in the authentication process and the way in which it interacts with the LG infrastructure between apps and the devices.

This Basically consists of four steps:
1. Authentication request – verifies user credentials.
2. Signature request – creates a signature based on the username from authentication request.
3. Token request – use the signature response as a header and username as the parameter to get an access token for the user account.
4. Login request – sends the access token in order to log in to the application.

Also Read GoCrack – Password Cracking Tool for Security Professionals to test Password Effectiveness

These steps allowed hackers to detect that there is no dependency between the authentication request and the signature or token request, Which helped them to create a fake username which seems legit and get control over the devices.

“As more and smarter devices are being used in the home, hackers will shift their focus from targeting individual devices to hacking the apps that control networks of devices. This provides cybercriminals an opening to exploit software flaws, cause disruption in users’ homes and access their sensitive data,” said Oded Vanunu, head of products vulnerability research at Check Point.

Mitigations

After This LG Released a security patch for their LG SmartThinQ (V1.9.23) mobile app and suggested Users keep their application updated To be free from such vulnerability.

LG now plans to join forces With Check Point an Israel based multinational Company who detected this flaw to Secure their Devices.

LG’s SmartThinQ® range of smart appliances and safety solutions enable users to access and maintain their homes from a smartphone.

Sales of the Hom-Bot robotic vacuum cleaner alone exceeded 400,000 in the first half of 2016.  In 2016, 80 million smart home devices were shipped worldwide, a 64% increase from 2015.