I just received a new Fire TV cube gen 3, because my old one is malfunctioning. I know, I hate these devices myself, but it’s the only option right now, since a new version of the Nvidia shield isn’t coming in the foreseeable future.
So, I plugged in the power chord and the HDMI cable into the cube.
When it booted up it showed a screen that it’s downloading the newest update. At first I thought this must be some typo-bug on the initial boot steps, because I haven’t even connected it to the internet yet, neither via cable nor did I go through the wifi setup.
After the update has finished, I was greeted with my real name and the cube indeed had the actual WiFi settings!
WTF?! How’s that even possible?
From @7eter below.
“Frustration-Free Setup utilizes a network of helper devices (such as compatible Echo devices, Fire TV devices, routers, or smartphones with certain Amazon apps) that are already connected to the internet to help you set up new devices in fewer steps. When you turn on a new compatible device, helper devices in range can help it connect to your networks and/or to Alexa via wifi, Zigbee, Bluetooth, or Matter.”
In other words: your amazon devices are freely giving your wifi info to any nearby new amazon device regardless of whether you’ve signed into that new device or not.
Begs the question: What other clearly private info do they give away with 0 auth or verification?
“Freely” if you enable the setting as the user posted above.
The verification still needs one of the devices listed in my post to be active on your wifi to allow the setup and communication.
The auth is likely done by device to device handshake. Its just that there isn’t a human involved.
Don’t get me wrong I hate Amazon as much as anyone and would never have one of their devices in my home.
But most of the other posts in this thread are missing the technical aspect of the question.
Depending on a setting being disabled thats more than likely on by default isn’t much comfort. Most people won’t know about or look for those kinds of settings, especially with the deceptive descriptions often used for features like these.
To be clear, I don’t use these devices either; I’m just concerned for those that don’t know any better.
Yes, that’s what I said; your amazon devices are giving away your wifi info to new devices. As in once you’ve allowed an amazon device onto your network, any new device can add itself to that network via your existing device without your input.
This happens before the new device has authenticated into your amazon account as it doesn’t yet have an internet connection (ie before its proven to be your device and not say a neighbours) and before you manually provide authentication for your wifi. Hence the ‘with 0 auth’.
A handshake between a device you own but have little control over and a device you’ve never seen before, may not have physical access too, and that could have been compromised before requesting your info. Great.
I’m not saying they’re beaming it out in plain text for all to read; just that they’ll give your info to a device you may not even be aware of let alone own or have any control over. That device may be a stock Amazon device, or it could be something more malicious.
Removed by mod
Yes, that is exactly what I’m saying as that’s what it sounds like.
If you can buy a new amazon device and have it connect to all your stuff without your input; what stops someone else buying an amazon device and connecting to your network with it?
Obviously I’m not worried about the device I actually receive; I’m concerned that someone can buy their own device and use it to connect to other people’s networks via existing amazon devices.
Removed by mod
Ie: any amazon smart device; which are becoming increasingly popular and found in many homes globally.
Also, I’m not taking about someone targeting me, you, or anyone specifically. I’m talking about someone wandering around looking for homes that happen to have a vulnerable device and seeing where they can get from there.
Really not hard to find.
Trivial when you consider not everyone lives in a single-family home with significant yardspace around it. Apartments exist, so do smaller multi-family dwellings.
The useful info here being your WIFI password (the info this connection is intended to spread) allowing an attacker to piviot to the rest of your network.
This would be where I’ve repeatedly talked about an attacker being able to purchase an amazon device, jailbreak it, and use it to connect to your network
They can buy a device from Amazon then have all the time in the world to figure out a method of retrieving data from it. Once a method is worked out, they then deploy it against unsuspecting victims. (ie any random home they can get near and find an amazon device thats broadcasting looking for new devices)
I completely agree which is why I’m not happy with Amazon providing a hole to achieve exactly that.
Can’t this all be prevented by the already connected devices checking if the new device matches a newly purchased, not yet set up device in your purchase history? Really slim chance someone eavesdrops on its id and retransmits fast enough to hijack the setup
Removed by mod