Hackers take control of over thousands of Chromecast streaming devices, exposing the vulnerability of the routers. The hackers – who go by the names of Hacker Giraffe and J3ws3r, utilized a bug called CastHack, which exploits the weakness in both Chromecast and the router it connects to. It utilizes the Universal Plug and Play (UPnP) functionality of some routers in order to remotely gain access to devices connected on their local networks.
The hack enabled them to play any YouTube video they wanted – including custom-made videos. But the hackers took this chance to shed light on the vulnerability in their internet routers and also expose the inherent bug which has been lurking around in Chromecast devices for almost 5 years now. A message titled “Attention” popped up on the affected devices. The message mentioned that their Chromecast/SmartTV is exposed to the public internet which thereby puts sensitive information at risk. And also directed them to a website where they could learn more about the problem and how to fix it.
And the hackers also took this ripe opportunity to promote their allegiance to the largest YouTuber – Felix Kjellberg aka PewDiePie and asked people to subscribe to him, to help him in his ongoing battle for supremacy against Indian Music Label/Channel T-Series.
Bishop Fox, a security consultancy firm first discovered this bug when the Chromecast debuted in 2014. According to a report by Tech Crunch,
the researchers found that they could conduct a “deauth” attack that disconnects the Chromecast from the Wi-Fi network it was connected to, causing it to revert back to its out-of-the-box state, waiting for a device to tell it where to connect and what to stream. That’s when it can be hijacked and forced to stream whatever the hijacker wants. All of this can be done in an instant — as they did — with a touch of a button on a custom-built handheld remote.
This isn’t the first time TheHackerGiraffe has pulled off something like this. Early December, he got into over 50,000 printers in the United States and Canada and printed out a message urging people to subscribe to PewDiePie and also unsubscribe from T-Series. While this may seem like a PR campaign, he did that to raise awareness about Cyber Security and the dangers of leaving vulnerable printers exposed to the internet.
[One thing to note is that PewDiePie himself doesn’t endorse any of this stuff and such activities are carried out by his fans merely for fun. Nothing to be taken seriously. ]
While most of the people whose devices got hacked, first the printers and now the Chromecasts, seemed to have gone into a state of panic, they missed the whole point of it all. Although he did promote PewDiePie as a joke, he did this to shed light on a more pressing issue – the safety of devices on the internet. It was a demonstration to show how easy it is to access vulnerable devices connected to the internet and carry out way more wicked activities. And also serves a wake-up call to the internet giants to reinforce their cybersecurity measures.
However, TheHackerGiraffe decided to hang up all this after major outlash by basically everyone on the internet and amid rumors that the FBI is after him. He has thus far deleted all his accounts, including Twitter, Cloudflare, GitHub, Discord, and Patreon.
TheHackerGiraffe, via Twitter (January 3rd 2019)
I’m escaping from all this. Paranoia won’t settle down. Will be watching DMs occasionally for important things. No tweets, no hacks, no anything for a while, please. I love you all. I hope what I’ve done has made the world just slightly safer.
HackerGiraffe, out.
