Categories: Hacks

Homehack Glitch : Hackers found a way to spy through LG SmartThinQ

Security Researchers have detected a flaw termed HomeHack in LG SmartThinQ mobile app that allows hackers to access all Electronic appliances present and get the live feed of the Surrounding through the integrated camera present in LG Hom-Bot robot vacuum cleaner.

The researchers discovered a glitch with the mobile app in the authentication process and the way in which it interacts with the LG infrastructure between apps and the devices.

This Basically consists of four steps:
1. Authentication request – verifies user credentials.
2. Signature request – creates a signature based on the username from authentication request.
3. Token request – use the signature response as a header and username as the parameter to get an access token for the user account.
4. Login request – sends the access token in order to log in to the application.

Also Read GoCrack – Password Cracking Tool for Security Professionals to test Password Effectiveness

These steps allowed hackers to detect that there is no dependency between the authentication request and the signature or token request, Which helped them to create a fake username which seems legit and get control over the devices.

“As more and smarter devices are being used in the home, hackers will shift their focus from targeting individual devices to hacking the apps that control networks of devices. This provides cybercriminals an opening to exploit software flaws, cause disruption in users’ homes and access their sensitive data,” said Oded Vanunu, head of products vulnerability research at Check Point.

Mitigations

After This LG Released a security patch for their LG SmartThinQ (V1.9.23) mobile app and suggested Users keep their application updated To be free from such vulnerability.

LG now plans to join forces With Check Point an Israel based multinational Company who detected this flaw to Secure their Devices.

LG’s SmartThinQ® range of smart appliances and safety solutions enable users to access and maintain their homes from a smartphone.

Sales of the Hom-Bot robotic vacuum cleaner alone exceeded 400,000 in the first half of 2016.  In 2016, 80 million smart home devices were shipped worldwide, a 64% increase from 2015.

VeLayUthamSelvAraj

Recent Posts

Docusnap for Windows Flaw Exposes Sensitive Data to Attackers

A recently disclosed vulnerability in Docusnap's Windows client software (CVE-2025-26849) enables attackers to decrypt sensitive…

1 hour ago

CISA Warns of Active Exploitation of Microsoft Windows Win32k Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2018-8639, a decade-old Microsoft Windows privilege…

2 hours ago

Update Alert: Google Warns of Critical Android Vulnerabilities Under Exploit

Google’s March 2025 Android Security Bulletin has unveiled two critical vulnerabilities—CVE-2024-43093 and CVE-2024-50302—currently under limited,…

4 hours ago

BigAnt Server 0-Day Vulnerability Lets Attackers Run Malicious Code Remotely

A critical vulnerability in BigAntSoft's enterprise chat server software has exposed ~50 internet-facing systems to…

4 hours ago

Bubba AI, Inc. is Launching Comp AI to Help 100,000 Startups Get SOC 2 Compliant by 2032.

With the growing importance of security compliance for startups, more companies are seeking to achieve…

6 hours ago

IBM Storage Virtualize Flaws Allow Remote Code Execution

Two critical security flaws in IBM Storage Virtualize products could enable attackers to bypass authentication…

6 hours ago