Could a Chromecast be compromised from its default open network?

Question

I left my apartment for few days, so I disconnected my wireless router but I forgot to disconnect my Chromecast as well. I remember that when a Chromecast can't find the network it was connected to anymore, it creates an open network that can be used to reconnect to another wireless network.

The issue is that I'm away from my apartment for a few days and my Chromecast is probably currently broadcasting an open network that anyone can connect to.

Even if there is no internet connection on that open network, there are two things I'm worried about.

1. The Chromecast could be attacked from a wireless exploit. We don't know how someone else's computer could be infected by malware, the Chromecast could be attacked once that infected computer connects to it (for example, by running wireless exploits against). Even, the worst scenario could be an attacker just connecting to that Chromecast open network and directly run exploits against it.

2. It might be possible for someone who can attack the Chromecast to get the wireless network password that the Chromecast was previously connected to. This password might be obviously stored somewhere on the Chromecast memory and with some access to the filesystem by a kind of jailbreak (for example, the point 1), it could be retrieved and used to connect to my wireless network.

Considering those two points, should I factory reset my Chromecast once I'm back to my apartment? Or even safer, should I get rid of this Chromecast considering that the firmware could have been compromised and buy a new one?

Answer 1

An attacker could connect to the open network, but there is nothing but the Chromecast itself they could reach there since nothing else is connected. If the TV is turned on, they could potentially cast to the TV and play whatever they wanted on it. This could be used for some less than fun pranks I guess.

As for your points #1 and #2, these are theoretically possible. Any device can be hacked. But it is not on the level I would expect from an opportunistic attacker who happends to stumble upon an open network. Unless you are a high value target, I would not be worried.

So should you factory reset the Chromecast? Yeah, if nothing else to make sure no one else but you has access to it. You could change your wifi password as well. But should you buy a new Chromecast? No. The cost benefit calculation on that one is not good. Theoretically, your TV could have been compromised through the HDMI connection of the Chromecast but you wouldn't throw your TV out because of this, would you?