Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hackers Are Taking Over Chromecasts To Promote a YouTube Channel (theverge.com)

Posted by BeauHD on from the device-vulnerabilities dept.

In what is being referred to as CastHack, hackers j3ws3r and HackerGiraffe are promoting Felix "PewDiePie" Kjellberg by forcing TVs to display a message encouraging people to subscribe to his YouTube channel. "The hack takes advantage of a router setting that makes smart devices, like Chromecasts and Google Homes, publicly viewable on the internet," reports The Verge. "The attackers are then able to gain control of the devices and broadcast videos on a connected TV." From the report: A website for the attack claims to count the number of TVs forced to show the PewDiePie message and currently says more than 3,000 have been affected. While it's not clear that this is an accurate number (it has reset several times), a number of people posted on Reddit that the video had appeared on their TV. Google tells The Verge it has received reports from people who had "an unauthorized video played on their TVs via a Chromecast device," but said the issue was the result of router settings. Both HackerGiraffe and Google told The Verge the best way for affected users to fix the issue is to turn off Universal Plug and Play (UPnP) on their routers. The two hackers said they were behind a hack in November that forced printers around the world to print out sheets of paper telling people to subscribe to PewDiePie.

47 of 90 comments (clear)

  1. Impressive... by fuzzyfuzzyfungus · · Score: 3, Insightful

    This story of spammers trying to drum up support for the incumbent puerile attention whore of youtube almost makes me think that the Iranian social media crackdown will do them some good.

    And that takes some doing. Good work guys.

    1. Re:Impressive... by Barny · · Score: 1, Insightful

      Ugh. Out of mod points, but I'll sit here and think really positive thoughts at you for a minute, okay?

      --
      ...
      /me sighs
    2. Re:Impressive... by Anonymous Coward · · Score: 2, Informative

      I have never cared for PewDiePie. Now, thanks to these imbeciles, I absolutely despise him.

    3. Re:Impressive... by Red_Forman · · Score: 2

      Virtual +5 insightful.

      The best way to gain support is not by pestering everyone about it.

      Everybody's heard of the Streisand effect, where an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely.

      Well, I'm suggesting we call this the PewDiePie effect, where an attempt to gain worldwide support for someone/something has the unintended consequence of destroying any chance of gaining more support and even destroying the support currently held for the said someone/something.

    4. Re: Impressive... by bickerdyke · · Score: 1

      Intresting enough.. the same hackers claimed to have done exactly that. But with an url to the same youtube-channel and not goatse.

      --
      bickerdyke
    5. Re:Impressive... by bickerdyke · · Score: 1

      According to some other newssource (heise.de) they rather use that guy as a new rickrolling target than actually endorsing him. (or to be as exact as I remember, they would rather prefer a personally owned channel to lead youtube statistics than a corporate commercial one like the one that recently took over the youtube lead)

      --
      bickerdyke
  2. So why totally open this port... by SuperKendall · · Score: 1

    Why does Chroecast open up a port, any port, to the whole wide internet? To the point where it's even uPnP compatible,, not just for network local devices...

    What purpose does that serve? When did that seem like a good idea?

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:So why totally open this port... by dissy · · Score: 4, Informative

      Why does Chroecast open up a port, any port, to the whole wide internet?

      It doesn't. The malware these people ran is what sent the uPNP packet to open holes in their router.

      The same method has been used by malware in the past to open tons of holes in NAT devices that claim to be firewalls, even SMB and remote desktop, iterating internal IPs in turn to try and find a vulnerable windows host.

      uPNP is simply retarded and shouldn't exist. Any user-level software capable of sending a UDP packet can render such a NAT device completely useless as a level of protection that an actual firewall wouldn't allow.

    2. Re:So why totally open this port... by squiggleslash · · Score: 2

      There's nothing wrong with uPnP, it does a job that needs doing at least until we have ubiquitous IPv6.

      There's plenty wrong with devices that get (however it's done) external connectivity and then implement zero security, effectively allowing their owners networks to be abused.

      This is 100% on Google and Chromecast.

      --
      You are not alone. This is not normal. None of this is normal.
    3. Re:So why totally open this port... by Junta · · Score: 2

      Well, it's largely on Google, in an ideal world it would be 100%. A device's security strategy should never include 'dear god please don't let internet hosts connect to me'

      However, UPnP is a problem in practice because we have *so many* devices that employ this strategy, and UPnP offers a trivial way for opening them up, as well as opening command and control ports open to a client device that should never be running a service, without even a way to request approval for a UPnP forwarding request from an authorized software.

      Practically speaking, routers should probably pair with some sort of phone app and do notifications to ask for approval when a upnp request comes in and not grant forwarding until approved.

      It is a shame that in practice internet capable devices have terrible security that keeps us from having nice things like internet services on devices.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    4. Re:So why totally open this port... by dissy · · Score: 1

      There's nothing wrong with uPnP, it does a job that needs doing at least until we have ubiquitous IPv6.

      I still feel it needs to be a touch more effort than the current state of effortless to punch a hole through NAT.
      I know expecting any effort from the common user is a step too far these days, but see below, you yourself just mistakenly claimed chromecast was effortless to access (which isn't true) and said that was a bad thing.

      There's plenty wrong with devices that get (however it's done) external connectivity and then implement zero security, effectively allowing their owners networks to be abused.

      Chromecast devices link into a google account before you can have them stream video from anywhere.
      That means you need to sign in to my google account, by password and 2fa, before you can do anything with it.

      In other words, even if I had my chromecast on the Internet, it's security would keep you from streaming random videos to my TV.
      That makes it more than zero security. Far more than uPNP requires to allow access to literally anything on the inside network in fact.

      Many people choose to defeat that security however by saving their passwords in their browser.
      But I'd be far more upset if google tried to remove that choice from me instead.
      They don't choose to get infected, but sometimes that happens too. It isn't exactly an unheard of thing even for the unwashed masses.

      Getting infected is the root of the problem here, not taking advantage of the users choice to defeat having password protection from what should be a secure computer.

    5. Re:So why totally open this port... by SuperKendall · · Score: 1

      Practically speaking, routers should probably pair with some sort of phone app and do notifications to ask for approval when a upnp request comes in and not grant forwarding until approved.

      Are there any routers that do this? It sounds like a great idea. I already have an app for my Lynksys unit, it would be a really nice feature to not let any devices take part of using PnP without my approving.

      --
      "There is more worth loving than we have strength to love." - Brian Jay Stanley
    6. Re:So why totally open this port... by AHuxley · · Score: 1

      Ads, always for the ads.

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:So why totally open this port... by tlhIngan · · Score: 1

      There's nothing wrong with uPnP, it does a job that needs doing at least until we have ubiquitous IPv6.

      And we'll still need it then. Because NOTHING in IPv6 guarantees that you'll have direct access between hosts using IPv6. (As in, firewalls exist)

      So even in an IPv6 world where everything has their own unique IP address (and the RIAA and MPAA can uniquely identify a host and the user associated with it to sue individuals - something you can't do with IPv4), firewalls will break direct connections. This is only obvious because if you think the IoT insecurity is bad now, where everyone has to poke holes through a NAT "firewall", imagine what happens if you were to connect said insecure devices to the raw internet.

      So no, you'll have IPv6 firewalls that require their own hole-poking system to allow certain ports to be open for a host in order to protect the host from the general internet.

      As for PewDiePie, well, considering he still makes millions of dollars, I'm guessing he's hurting because he's not making more millions of dollars. Either that or hackers are trying to find ways to cash in on those millions of dollars...

    8. Re:So why totally open this port... by Anonymous Coward · · Score: 1

      You're completely retarded and shouldn't exist.

      uPnP is a fine idea. It's the router manufacturers that screwed up by not making it so packets from outside the network can affect changes.

    9. Re:So why totally open this port... by Junta · · Score: 1

      No idea, just a thought off the top of my head. I just disable upnp as any things I want exposed I know enough to do it myself and it's such a rare phenomenon that the relative tedium is acceptable. Such a feature would be of great use to those lacking that degree of experience or putting gobs of enabled services on a network, but I don't need it so I haven't looked into it.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    10. Re:So why totally open this port... by thegarbz · · Score: 1

      uPNP is simply retarded and shouldn't exist.

      I agree. We shouldn't have broken the internet with NAT, we should have adopted IPv6 over a decade ago. Unfortunately what we have is known as trying to make do with a shitty situation.

    11. Re:So why totally open this port... by Rob+Y. · · Score: 1

      There's something like this on my new Netgear router. I have uPnP disabled on there, and when I went to connect my DVD player, it gave me a message to go to the router and press some button to allow it to connect. I forget what that security measure was called, but does it fit the bill?

      --
      Posted from my Android phone. Oh, I can change this? There, that's better...
    12. Re: So why totally open this port... by c6gunner · · Score: 1

      You have a 6 digit UID, and you don't know the difference between UPNP and WPS?

      No, it's not even remotely the same thing. The only thing they have in common is that they're both insanely bad ideas if you care about security.

    13. Re: So why totally open this port... by c6gunner · · Score: 1

      No, Chromecast doesn't require you to be signed into your account. You can set it up to prevent unauthorised users from streaming to it, but it doesn't do that by default. Plenty of people leave it completely unsecured. Mine is unsecured because I like the convenience of my guests being able to instantly connect to it. But I also have UPNP disabled on my router, so I'm not worried about anyone accessing it from outside my network.

    14. Re: So why totally open this port... by c6gunner · · Score: 1

      Yeah, insecure devices being accessed via UPNP is way worse than insecure devices connected directly to the net via their own IPV6 address!

    15. Re: So why totally open this port... by thegarbz · · Score: 1

      Yeah, insecure devices being accessed via UPNP is way worse than insecure devices connected directly to the net via their own IPV6 address!

      You are completely right. the UPNP hack has the knock on effect of breaking firewalls. If every device had it's own IPv6 address we wouldn't need the hack and our routers and firewalls could adequately mitigate this issue.

      Oh you were being sarcastic? Well in that case you're wrong.

    16. Re:So why totally open this port... by bickerdyke · · Score: 1

      But that wouldn't make it a chromecast problem at all but rather a malware on-some-other-platform problem.

      I agree with your uPNP assesment as we even have TWO uPNP problems here:

      the uPnp problem that allows anyone to open a port forwarding without any authentification and the uPNP/DLNA problem that allows anyone to discover and control AV equipment without any authentification.

      On the other hand: NAT was never meant as any level of protection. It's disability to open ports rendered several protocols useless behind a NAT (MS Netmeeting, some early VPN, FTP, any online multiplayer games that required one of the players doubling as a game server, ICQ and IRC file transfer) and was seen as a huge problem and something to avoid if you could get hold of enough static IP adresses for your LAN machines..

      --
      bickerdyke
    17. Re: So why totally open this port... by bickerdyke · · Score: 1

      No firewall was broken here. NAT is NOT a firewall and should NOT be considered as a security measure. The firewall-like behaviour is a side-effect that should not be relied on even though it has the same effect as you probably would configure an actual home-use firewall (everything out and nothing in)

      --
      bickerdyke
    18. Re: So why totally open this port... by thegarbz · · Score: 1

      No firewall was broken here. NAT is NOT a firewall and should NOT be considered as a security measure.

      The fundamental purpose of UPnP is to open ports through routing gear. Your claim that no firewall is broken here is a distinction without a difference for the consumer whose sole device incorporates the firewall and NAT in the same piece of equipment managed by a common UPnP interface.

      As for NAT being NOT a firewall, I caution against the use of capitals. NAT may not be a firewall in a fundamental sense but without statefull packet inspection and with a lack of knowledge of what to do with incoming packets that don't match any current states or any current routing rules it behaves identically to a firewall for all intents and purposes, albeit a very simple one.

      Firewall like behaviour is not a side-effect of NAT. NAT is side-effect of certain firewall features.

    19. Re: So why totally open this port... by bickerdyke · · Score: 1

      Well I agree (and already did) on the identical behaviour, but NAT was used to hook up your roommates PC to one dialup. In the late 90s you wouldn't even think of anything else but hooking up your PC directly to the Internet. (think of the AOL era...)

      Your company network probably had a firewall, but as likely enough public IP adresses for every workstation.

      But I guess we can agree on the technical aspects and that this is rather a historical question.

      --
      bickerdyke
  3. Complain to Google by magarity · · Score: 1

    Does YouTube not have a way to fine or otherwise punish this twerp for promoting himself like this?

    1. Re:Complain to Google by vux984 · · Score: 1

      What makes you think PewDiePie is behind it?

      I mean sure he's got motive and its possible. But I could see any number of fans doing this entirely on their own too. Or any number of haters too for that matter.

    2. Re:Complain to Google by dissy · · Score: 1

      At this point it's already a meme for anyone and everyone to add "subscribe to pewdiepie" as a joke.
      The time to accuse him has long since past.

      PS, subscribe to magarity!

    3. Re:Complain to Google by rtb61 · · Score: 1

      More likely a wide spread attack to gain media attention across a broad spectrum and used to force new corporate crack downs, mass censorship via the end of net neutrality. Corporations have the right to declare you a digital non-person, no internet access, no electronic payments of any form, no digital IDs, a non-person for all those who do not bend and scrape to corporate demands.

      --
      Chaos - everything, everywhere, everywhen
  4. No one should profit from crime by Anonymous Coward · · Score: 1

    So the obvious thing would be to unsubscribe from PewDiePie on mass

    Failing that just terminate the account altogether.

    1. Re:No one should profit from crime by DontBeAMoran · · Score: 2, Funny

      It's called a dip switch, you moran.

      --
      #DeleteFacebook
    2. Re:No one should profit from crime by omnichad · · Score: 1

      That's fine. It's French.

    3. Re:No one should profit from crime by Farmer+Tim · · Score: 1

      “En masse” is French.

      --
      Blank until /. makes another boneheaded UI decision.
    4. Re:No one should profit from crime by Phil+Urich · · Score: 1

      Whatta maroon!

      --
      I remember sigs. Oh, a simpler time!
  5. 3 points by Anonymous Coward · · Score: 1

    1) DISABLE UPNP NOW! It has to be one of the largest security risks possible on a home network.

    2) Shame on google for using UPnP to forward a port that allows remote control of the chromecast device. What purpose does this serve?

    3) Can PewDiePie just go away already? If you can't keep your subscriber count up by posting worthwhile content then just go away. Youtube should revoke all the subscribers him and his ilk have managed to gain for him by spamming and ramming PewDiePie down everyone's throat.

    1. Re:3 points by Anonymous Coward · · Score: 1

      He gained more subscribers when the Wall Street Journal wrote a front page column about him because he told a Hitler joke. Blame them.

    2. Re:3 points by Junta · · Score: 2

      1) I think Upnp could be useful, but it would only be useful for generating a selection of services to add on the router through some interface (it's web page or a phone app with notifications), rather than auto-granting. Having true peer to peer technologies without blessed cloud intermediaries would be nice.

      2) It sounds like they don't request that port be forwarded, but malware running on the same network segment is sending upnp packets on behalf of detected chromecasts to make them internet accessible, which circles around to point 1.

      3) While I do not particularly think PewDiePie is a particularly worthwhile source of content, odds are against him being in any way responsible for this campaign and instead someone else who finds it amusing to spam about PewDiePie for whatever reason.

      --
      XML is like violence. If it doesn't solve the problem, use more.
  6. PewDiePie can pay for an private attorney an publi by Joe_Dragon · · Score: 1

    PewDiePie can pay for an private attorney an public defender may be to over worked to put up a good case.

  7. under hacking / other laws PewDiePie is guilty of by Joe_Dragon · · Score: 1

    under hacking / other laws PewDiePie is guilty of an crime? and seeing how he makes an profit off of this and maybe even theft of services as some people are changed for data usage.

  8. Re:8 y34r old army wins again by MikeDataLink · · Score: 1

    iTS' bett3r than being hacked by CH1n4.

    That would be "Giiiina". Everybody knows this. Everybody agrees.

    --
    Mike @ The Geek Pub. Let's Make Stuff!
  9. Re:under hacking / other laws PewDiePie is guilty by dissy · · Score: 1

    by Joe_Dragon ( 2206452 )
    under hacking / other laws PewDiePie is guilty of an crime?

    Subscribe to Joe_Dragon!

    So under hacking laws, is Joe_Dragon guilty of a crime? If so, lets hope the above meme doesn't catch on for your sake.

  10. Opposite take, liking the vulnerability exposure by SuperKendall · · Score: 4, Insightful

    I really don't care to watch PewDiePie at all (I tried a little, once).

    However the actions of his hacking subscription army exposing the absolute dismal state of the Internet Of Thangs has me absolutely cheering him on and wishing for more, and more and more similar activity until even the least technical person says "wait a minute" to installing new network connected devices.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  11. Re:8 y34r old army wins again by fbobraga · · Score: 1

    Everybody knows this. Everybody agrees.

    I don't agree. Several other people don't, either.

    * Red danger! Cold War feelings...

  12. Re:Opposite take, liking the vulnerability exposur by sg_oneill · · Score: 1

    Yeah I tried once, just so I could work out what the f*** the kids where on about.

    Nope, definately a dad moment for me. Like , 30+ years ago my father being genuinely mystified as to why I liked Iron maiden so much when the Beatles and Elvis where soooooo hip! Yeah, thats me, 30+ years later wondering what the hell the little ones see in this jibbering incoherent walking-mess of a man playing video games.

    Oh well, one day she'll have her own kids and be baffled as fuck at them. I guess its the cycle of life.

    But I guess if people actually go and check their router settings, thats something resembling a net positive in the state of affairs

    --
    Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
  13. Re:Is this really related to Chromecast? by omnichad · · Score: 1

    While the primary problem is that UPnP doesn't require approval, the secondary problem is definitely that Chromecast doesn't authenticate incoming connections in any way.

  14. Re:Legacy connected devices... why? by bickerdyke · · Score: 1

    Why would one buy a connected device designed to play internet videos and not connect it to the internet?

    --
    bickerdyke