Slashdot Mirror
Some Sonos and Bose Speakers Are Being Hijacked To Play Ghostly Sounds (theverge.com)
An anonymous reader quotes a report from The Verge: Researchers at Trend Micro have found that certain models of Sonos and Bose speakers have vulnerabilities that leave them open to hijacking, as reported by Wired. The accessible speakers are being exploited by hackers that are using them to play spooky sounds, Alexa commands, and Rick Astley tracks. Only a small percentage of speakers by the two companies are actually affected, including some of the Sonos Play:1, the Sonos One, and the Bose SoundTouch. All it takes is for the speaker to be connected to a misconfigured network and a simple internet scan. Once the speaker is discovered via the scan, the API it uses to talk to apps can be utilized to tell the speakers to play any audio file hosted at a specific URL. Of all the models, between 2,500 to 5,000 Sonos devices and 400 to 500 Bose devices were found by Trend Micro to be open to audio hacking.
It's just the ghost of Harald "Bluetooth" Gormsson, King of Denmark, who resents the use of his name, spooking the users of those damn speakers from beyond the grave.
"and Rick Astley tracks"
This /. is so distant from the one I dwelt almost two decades ago that even a stupid meme name such as rickrolling has been forgotten.
Shitty internet connected product is shitty, anyone who buys this stuff deserves whatever happens to them.
this explains why there is zero independently verifiable evidence of any russian "election hacking".
russians must have hacked ghosts.
No, they were saying "Boo-urns."
The speakers are actually haunted by the spirits of Chinese workers in the factory they were made in, who jumped off the roof for insurance money. Strange messages end up in fortune cookies for the same reason.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
"Mr. President, this is God..."
Table-ized A.I.
What's to stop some questionable entity from playing subliminal messages while you sleep? They know you are asleep because they also made^H^H^HJ^Hhacked the voice controlled home assistant device that can hear you snoring. Sure just keep buying all this internet-connected-full-of-holes-crap because everyone needs more creepy in their life.
I read the first two sentences of the story excerpt aloud to my husband. Our kitchen-table-top Echo Dot then cheerily announced through its external speakers: "Shuffling songs by Rick Astley!" So thanks to Amazon Prime I now know that Astley recorded more than just THE song...
Peter, those are Cheerios.
Somebody write a bot. Somebody write a bot. Somebody write a bot. Somebody write a bot... Can we please have Rick Astley on all Bose and Sonos IoT speakers? Actually, on everything IoT. Someone's got to put and end to this IoT nonsense and Rick Astley might just be the guy to do it :)))
Debate is a form of harassment. Do not question my truth.
So this is what Internet sounds. Attach one on a public square as an art project and wait for the eventual Mao and Hitler speeches fill the air.
This refers to Alexa but it's close enough.
If it weren't for deadlines, nothing would be late.
but does anyone use these things for serious listening? Just tonite I heard a piece of Saint Saens Symphony #3 on the radio. It was just not satisfying, so I pulled my CD of it. The organ pedal part of this piece is just not the same unless it envelops you, and I just don't see these speakers doing it.
Watching the YouTube video it seems that you need either Port 1400 for sonus or 8090 for Bose open to the public internet, these devices require no ports open to function correctly so either people are putting these devices in the dmz or they are directly connections it to the internet with no firewall, I mean even shit firewalls wouldn't have that port open by default. So yes if you put a device on the web with random ports exposed the device is vulnerable. Not that it isn't a cleaver exploit but can someone explain to me how 5000 of these devices have public ips without a firewall in front of it?
I'm wondering if this can something to do with what happened in the American embassy in Cuba...
So glad we decided to invite all these devices into our homes attached to the internet. Itâ(TM)s like inviting roadents into your home just waiting to find a way into your stuff. None of these companies seem to have any clue how to protect them, and make them dummy accessible at the same time.
And that is to incorporate malware protection literally at the router level. Problem is, the only devices I know that can do that are the Norton Core router and the eero mesh routers running their subscription malware protection service.
An appropriate acronym, don't you think?
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user