Incident
incident:chromecast_exploitation_incident
Also: Cast hack, Chromecast hack
Mass operation that remotely played a video on approximately 65,000 Chromecasts and renamed thousands of others.
Mass operation that remotely played a video on approximately 65,000 Chromecasts and renamed thousands of others.
“In total he was able to play the video on 65,000 Chromecasts”
“the list of 120,000 vulnerable Chromecasts”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ATTRIBUTED_TO | Hacker Giraffe | Explicit | 31 |
| outgoing | COMPROMISES | Chromecast | Explicit | 31 |
| outgoing | INITIAL_ACCESS_VIA | Chromecast exposed API | Explicit | 31 |
| outgoing | INVOLVES | Google Home Device | Explicit | 31 |
| outgoing | INVOLVES | port 8008 | Explicit | 31 |
| outgoing | INVOLVES | port 8443 | Explicit | 31 |
| outgoing | INVOLVES | port 8009 | Explicit | 31 |
Chromecast exploitation incident ATTRIBUTED_TO Hacker Giraffe
The Chromecast exploitation incident is described as an operation conducted by Hacker Giraffe and User.
Explicit Confidence 99% · Jack Rhysider EP 31 Details
“Him and User had everything ready, the list of 120,000 vulnerable Chromecasts, the video, the script”
Chromecast exploitation incident COMPROMISES Chromecast
The incident caused Chromecasts to play a video and renamed many devices.
Explicit Confidence 99% · Jack Rhysider EP 31 Details
“he was able to play the video on 65,000 Chromecasts and renamed another 8,000 of them”
Chromecast exploitation incident INITIAL_ACCESS_VIA Chromecast exposed API
The Chromecast operation used exposed Chromecast APIs and publicly reachable ports.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“This API is open. What exactly can we pull from it?”
Chromecast exploitation incident INVOLVES Google Home Device
The Shodan results for the Chromecast operation also included Google Home devices with an accessible API.
Explicit Confidence 98% · Jack Rhysider EP 31 Details
“Apparently Google Home Devices were also opening up this port and they had an API, too.”
Chromecast exploitation incident INVOLVES port 8008
The Chromecast investigation identified port 8008 as an exposed web/API endpoint.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“I came across the port 8008 and 8443”
Chromecast exploitation incident INVOLVES port 8443
The Chromecast investigation identified port 8443 as the SSO version of port 8008.
Explicit Confidence 98% · Hacker Giraffe EP 31 Details
“port 8008 and 8443 which is basically the SSO version of 8008”
Chromecast exploitation incident INVOLVES port 8009
After Google disabled the initial YouTube API method, the operation was modified to use port 8009 and resumed.
Explicit Confidence 99% · Hacker Giraffe EP 31 Details
“I found out another port, port 8009 which uses Google’s own protocol.”