Skip to main content

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie.

By Editor

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years.

The attackers, who go by Twitter handles @HackerGiraffe and @j3ws3r, managed to hijack Chromecasts’ feeds and display a pop-up, spreading a security warning as well as controversial YouTube star PewDiePie propaganda.

The hackers are the same ones who hijacked more than 50,000 internet-connected printers worldwide late last year by exploiting vulnerable printers to print out flyers asking everyone to subscribe to PewDiePie YouTube channel.


This time, the hackers remotely scanned the internet for compatible devices, including Chromecasts, exposed to the internet through poorly configured routers that have Universal Plug and Play [UPnP] enabled by default.
The hackers then exploited a design flaw in Chromecast that allowed them to access the devices and hijack their media streams to display a video message (as shown below) on connected televisions without authentication.
"YOUR Chromecast/Smart TV is exposed to the public internet and is exposing sensitive information about you! To find more about what to do and how to fix this, visit https://bit.ly/CastHack for more information," the message reads. Besides security warnings, the hackers again took a chance to promote PewDiePie—a famous YouTuber from Sweden who is known for his game commentary and pranks and has had the most subscribers on YouTube since 2013.
PewDiePie Hack
The hackers even set up a dedicated website (now been taken down) for their hack, which they dubbed "CastHack," with a live counter displaying the total number of exposed devices and how many of them have been forced to play video in support of PewDiePie.
CastHack can be used to collect all kinds of data from victim's homes, including which devices their Chromecasts or Google Home is connected to over Wi-Fi, which Bluetooth devices it was paired with, how long it has been on, which WiFi networks it had previously connected to and what alarms have been set.

Moreover, an attacker can also remotely force affected devices into playing media of their choice, rename devices, force factory reset or reboot the device, force it to forget all WiFi networks, or force the affected device to pair with new networks.
Interestingly, Google was made aware of the Chromecast bug multiple times since 2014 shortly after the streaming device was launched and also acknowledged the hack, but the company has decided to ignore the issue.
Several users have confirmed that their devices were compromised. Users can fix this issue by just changing their router settings, stop forwarding ports 8008, 8443 or 8009, as well as turning off its Universal Plug and Play (UPnP) feature until and unless it is needed.
UPnP comes enabled by default on every internet-connected device, creating a hole in your router's security that could allow malware to infiltrate any part of your local network. Hackers have compromised UPnP several times in the past.

Comments

Post a Comment

Popular posts from this blog

UGANDA ELECTORAL COMMISSION TO ELIMINATE NATIONAL IDENTIFICATION CARDS (IDs) FOR 2021 GENERAL ELECTIONS.

By Editor
The elimination of using National IDs (Ndagamuntu) for the 2021 elections should not have come as a surprise. One would be very NAIVE to think that Bobi Wine has not prepared for this in his Business Plan under the RISK section. It is public knowledge that our EC is not independent.  It is also public knowledge that Military Dictator Yoweri Museveni will never lose an election. What stunned us this morning is when we noticed that on social media, people were mocking Bobi with his "get your Ndagamuntu".  We are on record for saying to all Our readers that the National ID is like Apartheid in South Africa. Students of History would know how those IDs were being used to arrest people, deny them jobs, deny them basic services. Consequently, Bobi was not wrong and will never be wrong on the Ndagamuntu. Except the ones attacking him and mocking him forget that in Uganda, now, no National ID (Ndagamuntu), no service.  If you have not been denied registering your child i...
Post a Comment
Read more

Here is Why Our Utterances For Praying Jesus And God To Come Liberate Ugandans, May Be Misplaced. This Phrase is like inform of a Letter To Some Categorized Section Of Ugandans.

By Editor
https://m.facebook.com/yusufosuta/photos/a.1896701010557789/2070383359856219/?type=3 OPEN LETTER TO NRM SUPPORTERS - NATIONAL ROBBERS MOVEMENT. .................................................................................. Last week of March, a friend told me to pray for Uganda.  I told him that he was an Idiot and we have prayed for too long and we are still hungry and sick and Jesus is not coming soon to liberate us. He then ignored the STUPID and sent me a picture we all now know.  It got me totally messed up.  This guy was telling me to pray then sends a picture of men bowing down in blood.  He might have meant guns but I blocked him because his utterances of praying for Uganda were misplaced. I unblocked him 3 weeks later and asked him about praying and assassinations.  His reply "eithrr prayers or guns or both". I hate violence with a passion.  So he is now blocked in like FOREVER. Do you feel safe?  Do not feel safe. Uganda regim...
Post a Comment
Read more

Parliament Urges Government to Provide Shs 4 Billion to Media Houses to Run Awareness Campaign on Tourism in Uganda.

By Editor
Parliament also urged Gov’t to provide additional Shs4Bn to UTB to engage international and national media houses in production of positive media stories for improved destination image, following reports of drop in number of tourists from US, Europe and China visiting Uganda. "The National Development Plan targeted to cumulatively attract 281,760 International Tourist arrivals from US, Europe & China but only 67,252 arrivals were registered by the end of the first half of FY 2023/24. The U.S, Europe & China were key target source for leisure tourist who stay longer than business tourists. However, statistics show that international arrivals from the aforementioned areas have continue to drop. The UTB requires Shs4Bn to engage international & national media houses in production of positive tourism stories to improve destination perception in light of recent controversies that shade the destination in a bad light. However, this has remained unfunded,” said La...
Post a Comment
Read more