0

Since a day or two I noticed suspicious activities from my Chromecast and Samsung SmartTV in my Firewall logs.

S Tue Feb 12 22:12:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=49083 DPT=57525 LEN=344 
S Tue Feb 12 22:12:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={CHROMECAST-IP} DST={MY-PC-IP} LEN=547 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=43783 DPT=57525 LEN=527 
S Tue Feb 12 22:12:02 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44931 DPT=57525 LEN=344 
S Tue Feb 12 22:12:02 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={CHROMECAST-IP} DST={MY-PC-IP} LEN=547 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=43100 DPT=57525 LEN=527 
S Tue Feb 12 22:13:55 2019 p4 kernel: [UFW BLOCK] Some Broadcast form my Router...
S Tue Feb 12 22:13:58 2019 p4 kernel: [UFW BLOCK] Some Broadcast form my Router...
S Tue Feb 12 22:14:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=44124 DPT=51786 LEN=344 
S Tue Feb 12 22:14:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={CHROMECAST-IP} DST={MY-PC-IP} LEN=547 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=54514 DPT=51786 LEN=527 
S Tue Feb 12 22:14:02 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=40748 DPT=51786 LEN=344 
S Tue Feb 12 22:14:02 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={CHROMECAST-IP} DST={MY-PC-IP} LEN=547 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=41755 DPT=51786 LEN=527 
S Tue Feb 12 22:16:00 2019 p4 kernel: [UFW BLOCK] Some Broadcast form my Router...
S Tue Feb 12 22:16:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=57653 DPT=54175 LEN=344 
S Tue Feb 12 22:16:01 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={CHROMECAST-IP} DST={MY-PC-IP} LEN=547 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33120 DPT=54175 LEN=527 
S Tue Feb 12 22:16:02 2019 p4 kernel: [UFW BLOCK] IN=enp3s0 OUT= MAC=... SRC={SMART-TV-IP} DST={MY-PC-IP} LEN=364 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=39294 DPT=54175 LEN=344
and so on..

In the beginning they simultaneously scanned the same destination port (see above, "DPT"). After a while they went for different ports. The behavior started suddenly and has not stopped since.

I thought this is related to the recent CastHack attacks, but my devices are working fine and no one has observed and documented the same behavior that I see.

I live on a remote place and my TV has LAN only.. So I assume it is not coming from my Wifi.

UPNP is disabled, no ports were exposed for the TV or Chromecast.

Does anyone else with a SmartTV or Chromecast see the same traffic in their network?

  • Chromecast uses the Device discovery protocols to scan the network. This might be normal behavior. – harrymc Feb 13 at 10:12
  • @harrymc: I thought so too but the ports do not match mDNS or DIAL protocol. I cropped these out form the log above as "Some Broadcast form my Router...". Furthermore, it bothers me that it is so consistent and the ports range down to >=30000 so far. – Kashimu Feb 13 at 12:43
  • It seems like the Chromecast extension uses ephemeral ports in an unrestricted manner. – harrymc Feb 13 at 16:01

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.