Exploiting a Chromecast bug that's been allegedly ignored by Google for almost five years, in combination with an inherent security flaw in some routers, a hacker has taken control of thousands of users’ Chromecast-connected devices.
Hacker Giraffe has remotely gained access to the TVs and smart devices of tens-of-thousands of users and displayed a pop-up that both warns of the exploit and links to a page listing the current number of affected devices.
Despite these seemingly noble intentions, the message also takes a chance to promote controversial YouTube personality, PewDiePie – a move this particular hacker has previously made by hijacking connected printers.
The bug has been dubbed CastHack and utilizes the Universal Plug and Play (UPnP) functionality of some routers in order to remotely gain access to devices connected on their local networks.
Consequently, users are able to block this kind of access to their network by disabling UPnP on their router.
Teaching an old bug new tricks
While technically this latest hack is made possible via a security flaw in a users’ router, the exploit related to the Chromecast is one that has been known since the year the device launched.
In 2014, security firm Bishop Fox found that it could gain control of a Chromecast by disconnecting it from its current Wi-Fi network in what’s known as a “deauth” attack and reverting it to a factory state.
It was confirmed that the device was still vulnerable to these attacks in 2016 by Pen Test Partners, another cybersecurity firm.
While the initial deauth attacks required the hacker to be within range of the target’s Wi-Fi network, this new breed of attack can occur remotely over the internet, via the UPnP flaw previously mentioned.
