16

I've recently noticed that a new device shows up as available to cast to from my android phone when I'm logged on to our home Wi-Fi. It's an LG Sk8100 TV, but as we own no such TV. I'm assuming it's the neighbour's.

Since our Wi-Fi is WPA2-PSK AES protected, and I have not shared the key with the neighbour, I'm worrying that our network is compromised.

Strangely though, checking the device list in the router, no TV shows up in the DHCP Client list or wireless connections for either 5Ghz or 2.4Ghz networks. The only connected devices are my desktop PC and my android phone.

So why can I cast to this mystery LG TV when I connect to our Wi-Fi, while no such TV seems to exist in the attached devices list of the router?

The TV does not show up if I disconnect Wi-Fi, or if I leave our apartment. It only shows up when connected to our Wi-Fi. If I try to cast to it, the connection times out and fails. I speculated that it was some Google thing tied to location, but it's still there with location tracking off on the phone.

It also seems that the only app that can "see" the phantom TV is YouTube for some reason. That is, other cast-enabled apps, like Netflix or Chrome, are not able to see the TV. Moreover, it only shows up in the YouTube app on my phone (a Huawei P20), so not on the desktop or my wife's phone.

I have now conducted another test where I set the router in MAC-adress whitelist-mode, and the TV is still there. So there is something really strange going on.

I'm leaning towards this being some Google software quirk rather than an attack, but maybe someone here recognizes the issue and has input.

One thought, could the TV show up through my ISPs CG-NAT? Or in the WAN above the router in some way?

hexamon
  • 273
  • 1
  • 2
  • 7
  • 2
    Have you asked your neighbors if they are logged into your wifi? – Tom K. Feb 26 '19 at 11:41
  • 2
    If I recall correctly, the first part of the pairing is that the device itself broadcasts an SSID that your phone can pick up. So if you're nearby you can attempt to pair, but only if you can enter the code shown on-screen. I've run into this in hotel rooms that offer modern Android-based TVs. – Polynomial Feb 26 '19 at 11:53
  • 5
    @TomK. Interacting socially? Don't be absurd. Jokes aside, it's a big building so I'm not sure whose TV it is. Plus, in the unlikely event that they are logged on I'd like to know to what extent the network is compromised before confronting them. – hexamon Feb 26 '19 at 13:53
  • I think you should go to the phone manufacturer(i.e. Huawei) support site and ask them whether this is as intentional or is a bug. – mootmoot Mar 19 '19 at 13:13

2 Answers2

7

Because you are talking about Chromecast, you need to look at the abilities of Chromecast in guest mode:

https://support.google.com/chromecast/answer/6109286?hl=en-GB

Guest mode makes it easier for your friends to cast their favourite media to your Chromecast from a mobile device without connecting to your Wi-Fi network.

So, what you are likely seeing is a device that is Chromecast enabled with guest mode on (I think this is by default). You could try to cast to that device, but there is a pin code that pops up to prevent neighbours from casting who cannot see the screen.

Only cast-enabled apps can see it, so the YouTube app makes sense. If you opened Chrome, you might be able to cast a tab, too.

With the recent details of it only showing up in one app in one device and not in any other apps and not on any other device, it looks more like a bug in that app being able to pick up a castable device that it should not.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • The thing is, it only shows up: 1) When connected to our Wifi. 2) In the YouTube app (not other cast enabled apps) 3) On my phone Edited my question to clarify this. – hexamon Mar 19 '19 at 09:42
  • 1
    @hexamon Is 1. really true? Or does it also show up if you delete your Wifi connections, so you are not connected to the Wifi but have Wifi enabled on the phone? I assume you are always automatically connected to your Wifi network, if you enable Wifi on the phone? – Josef Mar 19 '19 at 10:12
  • @hexamon with all the rest of the details you added, it does not look like a compromised network, and it does not look like normal Google Cast behaviour. It also does not look like a security issue but a weird bug. – schroeder Mar 19 '19 at 10:14
  • Same thing happened to my wife and I in our suburban home. Someone connected to our tv and started casting shows. We thought it was our kids but turns out we had enabled guest access at some point and one of the neighbors didnt know they were connected. – Joe B Jul 03 '20 at 04:13
1

Some TV sets have a feature named Wi-Fi Direct, where the TV acts as a router itself for your device so it can cast for the TV. If it is the case, you should see the TV even if it is outside your Wi-fi.

Thiago Escobar
  • 79
  • 7
  • 2
    But wouldn't that mean the TV should show up as a router? As it is now, it only shows up as a castable device when I'm logged on to our wifi. – hexamon Mar 06 '19 at 08:12