| Google Chromecast (3rd Gen) | ||
|---|---|---|
|
Security Grade
Calculator v
|
Google Chromecast (3rd Gen)
Brand: Google (Parent: Google LLC) Category: Streaming device • Model / Gen: NC2-6A5 Release Date: 2018-10-10 • Status: End of sale Classification Date: • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | No exposed debug ports; physical tampering not documented. |
| Known vulnerabilities | Rare | 🔗 Proof | DNS rebinding (CVE-2018-12716) and U-Boot privilege-escalation flaws (CVE-2023-48417/48424/48425/48426). |
| Prior attacks | Rare | 🔗 Proof | 2019 CastHack hijacked idle Chromecasts; Princeton/UCB demonstrated DNS-rebinding takeovers. |
| Updatability | Very common | 🔗 Proof | Google auto-updates Chromecast firmware OTA. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | Local /apps endpoint on port 8008 accepts GET/POST/DELETE without authentication. |
| Communications | Encrypted with obselete encryption | 🔗 Proof | Cloud traffic uses TLS, but the local port 8008 HTTP interface is plaintext. |
| Storage | Encrypted with up-to-date encryption | 🔗 Proof | No sensitive local storage; content is streamed. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Managed through a full Google account. |
| Authentication | Secure | 🔗 Proof | Google account OAuth authentication. |
| Brute-force protection | Exist | 🔗 Proof | Google account login rate limiting. |
| Event logging | Access event logged | 🔗 Proof | Google account activity is logged. |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | Google account password complexity enforced. |
| Category Score | Score: 1 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | Chromecast firmware (Linux-based) (Companion App: Google Home app) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: No local storage (streaming only) |
| Power, Battery & Charging | Battery: • Power: Micro-USB adapter • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Wi-Fi 802.11ac, HDMI |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Chromecast 3rd Gen has a mature account layer and frequent updates, but its unauthenticated local /apps API on port 8008 lets any LAN device control playback, which was demonstrated in the 2019 CastHack hijacking campaign.
