Hackers have hacked thousands of exposed Chromecasts to warn users of a security flaw that affected their streaming devices.
Calling themselves as Hacker Giraffe and J3ws3r, the hackers discovered a way to trick Google's streaming device into playing any YouTube videos they want.
Knowing how to hijack Chromecast, the hackers forced affected Chromecasts to display a popup notice that is shown on the connected TV, warning those users that their router is misconfigured, making their Chromecast and smart TV vulnerable to hackers like themselves.
Since the hackers were able to get people's attention, they too ask affected users to subscribe to YouTube star PewDiePie.
After all, Hacker Giraffe was also the culprit behind the hijacking of some 50,000 printers worldwide, that saw the devices printing out a message encouraging owners to subscribe to PewDiePie’s channel.
Read: The War Between PewDiePie And T-Series For The Most YouTube Subscribers
The bug in question is called 'CastHack'.
What it does is allowing the exploits of Chromecast's weakness, as well as the router that connects to it. The hackers said that the flaw can be mitigated by simply disabling the Universal Plug and Play (UPnP).
According to a Google spokesperson clarifying the issue:
The flaw can be traced back to 2014, when a security consultant Bishop Fox found a bug which allowed hackers to hijack Chromecasts. This was not long after the device was first debuted.
Fox discovered that hackers could conduct a "deauth" attack which would disconnect the Chromecast from the router's Wi-Fi, to then cause them to revert back to their default factory state. As the Chromecast waits for a device to connect to and what to stream, this is when the device is most vulnerable.
While this bug has been around for years, the CastHack exploit is said to be different, despite the method of exploitation is the same.
CastHack here, can be exploited through the internet. What this means, anyone with internet access can hack the vulnerable Chromecasts. This is a contrast to Bishop Fox's "deauth" attacks which can only be carried out within range of the Wi-Fi network the Chromecast is connected to.
This exploit is alarming, as hackers can simply make vulnerable Chromecast to run custom voice command.
For example, hackers can force a Chromecast into loading a YouTube video created to trick an Amazon Echo to say something like: "Alexa, order an iPad," or worse like: "Alexa, turn off the house alarm."
While smart assistants like Echo or Home are widely considered as secured, they can still be confused when they overhear words from television or radio, acknowledging them as actual commands. Since these gadgets are prone in overhearing things they shouldn't, this bug can be a catastrophe.
"Google needs to properly fix the Chromecast deauth bug that allows casting of YouTube traffic," said Ken Munro who founded Pen Test Partners.
