23 lines
No EOL
1.7 KiB
Markdown
23 lines
No EOL
1.7 KiB
Markdown
# Exploiting Insecure WIFI Speakers
|
|
|
|
This is very old, from when I was around 18. But it was fun, so I thought I'll describe the process from memory.
|
|
|
|
I knew someone who had [Bluesound](https://www.bluesound.com/) WIFI speakers and I got curious about them.
|
|
|
|
They were controllable by a dedicated smartphone app.
|
|
|
|
I installed a packet capture app on my phone and tried a bunch of things in the Bluesound app. To my amazement, the app was sending pure, **unencrypted and unauthenticated `http` requests** to the speaker for every action I took, like play, pause, change track, etc. I captured enough to reverse engineer the protocol.
|
|
|
|
What I thought would be fun, was to write a script that scans the whole network for Bluesound speakers, and then plays the [nyancat song](https://www.youtube.com/watch?v=2yJgwwDcgV8&pp=ygUIbnlhbiBjYXQ%3D) on all of them (it was still enough of a meme back then).
|
|
|
|
[bluesound.py](bluesound.py) is that script, I am posting this unedited, just the way I found it on my hard drive. It's fun to see how differently I approached coding back then and how much I've learned since. I'm not even sure the network scanning code works, it looks like it shouldn't :) I probably didn't know about subnets and netmasks.
|
|
|
|
## is this kind of a real vulnerability?
|
|
|
|
If you search on Shodan for `Brand Display Name: Bluesound` ([link to search](https://www.shodan.io/search?query=Brand+Display+Name%3A+Bluesound)), it shows 137 results. This means you can control other people's speakers with `curl`!
|
|
|
|
so idk
|
|
|
|
## Disclaimer
|
|
|
|
Please be responsible with this. I am not accountable for misuse of this code or technique, I am just sharing an interesting find. Only try it at your own risk, on devices you own or have the owner's informed consent for. |