Chromecast exploitation incident INVOLVES port 8009
After Google disabled the initial YouTube API method, the operation was modified to use port 8009 and resumed.
Explicit Confidence 99% · Hacker Giraffe EP 31 Details
“I found out another port, port 8009 which uses Google’s own protocol.”