Rss

Is Best Buy’s Insignia branded Google smart speaker spying on you?

I really wanted to like it because it is what could have been the perfect combination of an alarm clock and a smart speaker. However, it might hide a dark secret!

There was a moment where the speaker would glitch out and the time would start blinking dashes across the screen. I didn’t think much of it at the time and their tech support for Insignia explained how to reboot it a special way to pretty much clear its head and get it working again.

Then a day came where I heard it say something. When I said “Hey Google, what did you say?”, it said something like “I said ok, I’ll be quiet”. Looking at the app, it showed that someone told it to hush. Listening to the recording of the audio/voice it listed, it wasn’t mine and no one else was there. It was a quiet house when this happened. No conversations or anything else for it to pick up.

Then I started looking further into it. Looking at the logs within the firewall on the network, I saw odd things coming from its IP. Things like:

site allowed www.jovetech.com/down/YST/H/yst_usa.txt] from source 192.168……
site allowed www.jovetech.com/down/YST/H/yst_home.txt] from source 192.168……..

I found out these calls are common for Chinese cams designed by Jovetech, which is one of China’s leading companies in DVR and other IP cam/surveillance recording devices (usually cameras, DVR cams, spycams, etc). This is common for other Chinese cams that dial home (China) as well as you find out their insides (Despite the brand) actually come from Jovetech.

You could easily pull various things up on the camera based on using it’s IP in a browser and reading about paths you can visit on some of those questionable cameras caught calling home. Things like:

http://192.168.(censored)/cgi-bin/ which brings it’s CGI files right up…

and

http://192.168.(censored)/cgi-bin/jvsweb.cgi?username=admin&password=&cmd=yst&action=get_video which brings up the following message in your browser: “{“status”:”ok”,”data”:[{“id”: 1,”stream0″:”rtsp://192.168.(censored)/live0.264″,”stream1″:”rtsp://192.168.(censored)/live1.264″}]}”

Accessing the IP address of the device (on the network) within your browser directly (http://192.168.(censored)) leads to a remote management setup. Who exactly….is supposed to be managing a smart speaker remotely?

The warning signs go on and on from there looking at other sites picking apart some of those cameras. All leading to the idea that Google might not be the only one spying on you when you use this third-party Google speaker.

At this point, I have ceased any purchase, usage or recommendations of Insignia products. It just isn’t worth taking the chance.

(Note, I censored some of the address information throughout for security reasons clearly).

Share

Leave a Reply