security Episode III: Revenge of the Casts - Unsecured networks used to promote PewdiePie

[rcmaehl]

Source:
CNet
ZDNet

 

Summary:

War! IoT devices are crumbling

under attacks by The Hacker Giraffe,

a PewDiePie subscriber. There are exploits

on both LANs. Ads are everywhere.

In a stunning move, the

notorious scripter, Friendly 

H4xx0r, has swept into 

over 5,000 unsecured

smart cast devices

As the news sources attempt
to report on the issue with their
valuable pop-ups, one man brings

the summary to the LTT community...

 

Media:

 

Quotes/Excerpts:

Quote

Thousands of internet-exposed Chromecasts, smart TVs, and Google Home devices...play a video urging users to subscribe to PewDiePie's YouTube channel. The main hacker behind this hacking campaign...TheHackerGiraffe...explained on Twitter that CastHack takes advantage of users who use incorrectly configured routers. The ports are 8008, 8009, and 8443, which are normally used by smart TVs, Chromcasts, and Google Home for various management functions. This allowed FriendlyH4xx0r to set up a script that scans the entire internet for devices with these ports exposed. Once devices are identified, the hacker said another script renames the devices to "HACKED_SUB2PEWDS_#" and then tries to autoplay the video. The video is part of a guerilla marketing campaign. TheHackerGiraffe is already infamous after last month he/she hijacked tens of thousands of printers and made them print a similar message. TheHackerGiraffe is also running a web page with stats...the page showed that FriendlyH4xx0r had managed to rename and/or play the pro-PewDiePie YouTube video on more than 5,000 devices already. This same page clearly states, the hack doesn't exploit a vulnerability in any smart TVs, Chromecasts, or Google Home devices, but just takes advantage of improperly configured routers. Users can protect their devices by disabling UPnP services on their router. TheHackerGiraffe also hinted earlier today on Twitter that he is looking into expanding the scripts to add support for targeting Sonos devices as well.

 

My Thoughts:

I surely hope both of these people are not located within the US as the Computer Fraud and Abuse Act (CFAA) doesn't take kindly to stuff such as this. Regardless, this youtube subscriber war has hopefully brought the insecurity of thousands of home networks into the light of the people who own them. While I don't condone them, I'm interested in seeing what Smart Devices are abused next.

[Misanthrope]

You know it is not often that groups of people piss me off more than large corporations like Google but pewdiepie fans and Felix himself? Yeah they're quite successful at it.

[Guest]

Network  Review

[WereCat]

9 minutes ago, RorzNZ said:

Network  Review

You connect, you lose! 

 

I find it incredible how this entire pewdiepie vs T-Series turned into a huge subscriber avalanche effect for Felix. He gained millions of subscribers in just a single month. Other channels don't get that in years. 

[GoldenLag]

"Subscribe to PewDiePie" is just a an excuse to do wacky stuff and have it get traction online

[wONKEyeYEs]

16 minutes ago, Misanthrope said:

people piss me off

I'm never going to Mexico after seeing this...

[ZacoAttaco]

These attacks all seem to relate to the same issue, incorrectly configured routers leading to open ports.

1 minute ago, GoldenLag said:

"Subscribe to PewDiePie" is just a an excuse to do wacky stuff and have it get traction online

A more true statement, I have not heard.

[GoldenLag]

1 minute ago, ZacoAttaco said:

A more true statement, I have not heard.

I mean, "Komi-san is our empress and Savior" is a more true statement. But i guess the other one is pretty true aswell

[ZacoAttaco]

2 minutes ago, GoldenLag said:

I mean, "Komi-san is our empress and Savior" is a more true statement. But i guess the other one is pretty true aswell

You lost me there...

 

Here's the link the HackerGiraffe provided, interesting read.

https://casthack.thehackergiraffe.com/#faq

Quote

How do I fix my device?

Disable UPnP on your router, and if you're port forwarding ports 8008/8443/8009 then STOP forwarding them.

Super interesting stuff, using speedguide.net you can search these to see more information regarding these ports and what they are commonly used for.

[Misanthrope]

14 minutes ago, wONKEyeYEs said:

I'm never going to Mexico after seeing this...

That was filmed in Chile actually but point well taken.

[GoldenLag]

1 minute ago, ZacoAttaco said:

You lost me there...

To keep it short. For those interested:

Spoiler

This is empress Komi-san

 

She is from: Komi-san is bad at communication, which is a very wholesome read for the entire family.

 

[Arika]

1 minute ago, GoldenLag said:

To keep it short. For those interested:

  Hide contents

 

This is empress Komi-san

 

She is from: Komi-san is bad at communication, which is a very wholesome read for the entire family.

 

 

 

it's a very cute manga. the art style is a bit....non-conventional.

[ZacoAttaco]

Just now, GoldenLag said:

To keep it short. For those interested:

  Reveal hidden contents

This is empress Komi-san

 

She is from: Komi-san is bad at communication, which is a very wholesome read for the entire family. 

 

You haven't sold me on anime/manga yet...even though it seems very popular on the forum actually .

[S w a t s o n]

This is now an anime thread

[GoldenLag]

Just now, S w a t s o n said:

This is now an anime thread

Spoiler

I tried to keep it short. But i guess ill be cutting the thread short by derailing the entire thread

The question is at this point: when will we get propper dynamic port allocation with routers and such in the comming years to avoid this sort of exploitation

[wONKEyeYEs]

2 minutes ago, S w a t s o n said:

This is now an anime thread

Yes, that's how anime affects me too...

 

[ZacoAttaco]

1 minute ago, GoldenLag said:

The question is at this point: when will we get propper dynamic port allocation with routers and such in the comming years to avoid this sort of exploitation 

For the uninitiated, how would this stop these kind of attacks?

[GoldenLag]

1 minute ago, ZacoAttaco said:

For the uninitiated, how would this stop these kind of attacks?

I have no idea. I was just uttering some clever sounding series of hyroglyphics in a desperate attempt to get this thread back on track.

[ZacoAttaco]

3 minutes ago, GoldenLag said:

I have no idea. I was just uttering some clever sounding series of hyroglyphics in a desperate attempt to get this thread back on track. 

A more true statement, I have not heard.

[Drak3]

55 minutes ago, ZacoAttaco said:

You haven't sold me on anime/manga yet

It's like DC or Marvel comics, except that there are some good series out there.

 

57 minutes ago, Arika S said:

the art style is a bit....non-conventional.

Neither is Pewdiepie's advertising campaign.

[Arika]

4 minutes ago, Drak3 said:

Neither is Pewdiepie's lunatic fan's advertising campaign.

FTFY

[ZacoAttaco]

6 minutes ago, Drak3 said:

It's like DC or Marvel comics, except that there are some good series out there. 

I have some experience with One Piece and Kurukko Basketball, not to derail this thread more so.

[Cyberspirit]

I feel like this will end up hurting Pewdiepie rather than help his channel grow.

Eventually, people will either get sick of these hacks or, the hackers will take it too far. (If they haven't already)

[Drak3]

8 minutes ago, Arika S said:

FTFY

Nah, it's the cool thing to blame someone who isn't at fault.

[BachChain]

Maybe I'm stuck in my bubble of competence, but what kind of router just has random ports open and forwarded.