The local API has changed

[tonybfox]

It looks like google have changed the api as I'm getting 403 Forbidden for anything other than /setup/eureka_info and that now return a public_key

[rithvikvibhu]

Thanks for letting me know! Will take a look at this in a few days. Hopefully, it's just an auth system that's easy to replicate.

[stboch]

I was digging in a bit to see if I can figure out what is going on... it seems that google has moved local communication to port 8443. I tried to do a little MitM but it seems that google is doing some application cert validation. (Either that or something else I did is wrong) They also changed it to require a client ssl for authentication.

[klimov-gett]

@stboch i think you're on point regarding application certificate:

i figure :8443 was google's port for SSL so i did a GET to https://192.168.1.219:8443/setup/bluetooth/status (since auto-connecting to bt speakers is what i do with this api)
as a result i received "Error: Peer certificate cannot be authenticated with given CA certificates"

after disabling certifcate validation i got 401, which reads "similar to 403, but in this case authorization is possible"

[cmorche]

What's odd for me is that this is still all working on 8008, and I'm even part of the preview program... This is the first time learning of the local API, so I guess I shouldn't bother spending too much time mucking about.

[ludeeus]

It looks like the change has rolled back, every endpoint I have now tested returns the expected result 🎉

[raddacle]

It looks like the change has rolled back, every endpoint I have now tested returns the expected result 🎉

You're right! Though, I had to reboot my GH devices for it to revert

[jamieshaw]

I've been seeing this flip flop between available and unavailable for the past few days. Not entirely sure what's triggering it…

[Leatherface75]

I think they are preparing some sorts of authorization for higher security and maybe because of closing down NEST API and move it to the Cloud instead.

[rithvikvibhu]

So I finally got my hands on a GH and some updates.

First, the simple way of logging network traffic (with PacketCapture) didn't work because it's a different port and other problems.
Tried setting up proxies with burp and mitmproxy, but it wasn't possible to forward other ports with ProxyDroid (even with root). There is also SSL pinning, but Frida was able to bypass that.
Finally, I set up a hotspot and started to capture with Wireshark, but during all this, my GH reverted back and I didn't have a chance to capture anything :/ Must have been because of one of the reboots.
So yay that it's working right now, but auth may be back at any time. We'll just have to wait till then, I guess.

Simultaneously, I was going through the latest decompiled app and found some interesting bits. Most of the requests had an extra header cast-local-authorization-token. This is likely what we need to get. Unfortunately, the code is obfuscated and I couldn't find what this field should contain or how it is obtained. Will keep trying.

There are also more details on /setup/eureka_info than the docs, including a local-authorization-token-hash or something similar. Again, I didn't get to try this because it reverted back to not requiring any token.

Also, not sure since when, but there's a lot of Nest libraries now. Including Weave stuff (maybe https://openweave.io, haven't really checked it out yet).

That's it for now. If someone knows about the token or has any more info, feel free to comment here. I'm leaving this issue open.

[jkpe]

@rithvikvibhu All of my Google Home Mini in the UK are in a state where they return a 403, if I can help in debugging this let me know

curl -I http://bedroom-ghome.lan:8008/setup/eureka_info
HTTP/1.1 403 Forbidden
Content-Length:0

[rithvikvibhu]

Hey @6a61636b. That's interesting. /setup/eureka_info is the only one everyone could access when other endpoints returned 403.
Can you try /setup/bluetooth/status?

[jkpe]

curl -I http://bedroom-ghome.lan:8008/setup/bluetooth/status
HTTP/1.1 403 Forbidden
Content-Length:0

According to the Google Home app it is running System firmware version: 156414, Cast firmware version: 1.40.156414

[thorleifjacobsen]

I can confirm the issue here in Norway on both a Chromecast Ultra and Chromecast 3 and the old Chromecast (not key fob). They all this morning returned 403. After a reboot they started working again.While they were at 403 I could not see any http data going through wireshark when using google home app. Everything went through 8443 and 8009.

I have the pcap file from my chromecast while it had 403 error on google home app. Android -> chromecast ultra configuring and rebooting once if that helps. Would like to send it privately if you need it.

Current Cast Version where API Works
"build_version":"156414","cast_build_revision":"1.40.156414"

[Sennevds]

curl -I http://bedroom-ghome.lan:8008/setup/bluetooth/status
HTTP/1.1 403 Forbidden
Content-Length:0

According to the Google Home app it is running System firmware version: 156414, Cast firmware version: 1.40.156414

You need to use the small i.
So curl -i http://bedroom-ghome.lan:8008/setup/bluetooth/status