Hackers who reportedly pirate yard of Chromecast cyclosis devices on Monday used them to alarm owner to a golf hole in their security , while also plugging their favorite YouTube star — perennialedgelordPewDiePie , a.k.a . Felix Kjellberg
TechCrunch reported Wednesdaythat the hackers , Hacker Giraffe and J3ws3r , had taken advantage of know upshot with Universal Plug and Play ( UPnP)—a local networking communications protocol with a baffling history — to hijack G of Chromecast . by and by , however , multiple outside experts throw doubt on whether UPnP was even the topic . The lawsuit of the divergent explanations was not immediately clean . ( just invalid forwarding on port 8008 and 8443 in a router ’s will apparently solve the job for most users . )
The website reported :
Bishop Fox , a security consultancy business firm , first found the germ in 2014 , not long after the Chromecast debuted . The investigator found that they could acquit a “ deauth ” attack that disconnects the Chromecast from the Wi - Fi internet it was connected to , induce it to retrovert back to its out - of - the - box res publica , waiting for a equipment to tell it where to connect and what to stream . That ’s when it can be pirate and forced to stream whatever the hijacker want . All of this can be done in an New York minute — as they did — witha touch of a clitoris on a custom - built handheld remote .
Two years later , U.K. cybersecurity firm Pen Test Partners discovered thatthe Chromecast was still vulnerable to “ deauth ” attacks , making it well-fixed to play content on a neighbor ’s Chromecasts in just a few minutes .
allot to TechCrunch , Hacker Giraffe forced M of Chromecasts to play a telecasting warning that “ YOUR Chromecast / Smart TV is endanger to the public internet and is exposing sensitive data about you ! ” They also providea URLfor afflicted users instructing them to incapacitate UPnP on their router and stop send on ports 8008 , 8443 , and 8009 . ( The URL has since been taken offline . )
https://twitter.com/embed/status/1080895526885883904
One potential way to ill-treat the Chromecast , TechCrunch noted , was to get at other voice - controlled devices in the same room by upload YouTube picture that declaim commands .
The day after the report prank move viral , Giraffe publish an receptive letter saying they ’d quit hacking due to scare attacks and anxiety evoke by their veneration of getting capture . They also cite negative backfire from the stunt . “ I just wanted to inform mass of their vulnerable devices while bear out a YouTuber I like . I never meant any damage , nor did I ever have any ill intentions , ” they said .
In a program line to TechCrunch , Google acknowledged it had received reports of the television pop up on Chromecasts , but said : “ This is not an issue with Chromecast specifically , but is rather the solvent of router options that make smart gadget , including Chromecast , publicly approachable . ”
[ TechCrunch ]
fudge factor : An earlier version of this article , include the newspaper headline , identified a Chromecast “ exploit ” involving Universal Plug and Play ( UPnP ) . ab initio , port - furtherance and a UPnP flaw were both think to be the issue enabling the cyberpunk ’ prank , but security research worker have called into question whether UPnP was involved at all give that the job can be fixed without disabling UPnP. The newspaper headline and the clause have been updated throughout to chew over the unexampled info . We repent the error .
Daily Newsletter
Get the beneficial tech , science , and culture news in your inbox day by day .
News from the futurity , return to your present .
You May Also Like
